Skill UI

Automates discovery and monitoring of threat actor C2 infrastructure by ingesting passive DNS, certificate transparency, WHOIS, and IP enrichment data to build a continuously updated graph of related domains, hosts, and registrars for intelligence or incident response teams.

Conducts passive OSINT reconnaissance to map an organization’s external attack surface, harvesting DNS, certificate, cloud, personnel, and leak intelligence before active penetration testing or red team work.

Builds a passive DNS analysis pipeline that flags DNS tunneling attempts by inspecting query entropy, subdomain length, volume spikes, TXT abuses, and response payload sizes so SOCs can detect exfiltrating data hidden in DNS traffic.

Step-by-step skill to hunt DNS-based persistence by auditing zone baselines, querying SecurityTrails passive DNS, analyzing provider audit logs, and correlating anomalies to malicious infrastructure for actionable reports.

Performs comprehensive API discovery across an organization using passive traffic analysis, active scanning, DNS enumeration, JavaScript scraping, and cloud inventory to catalog documented, shadow, zombie, and deprecated endpoints for security assessments.