Skill UI

This skill provides comprehensive methods for collecting and synthesizing Open-Source Intelligence (OSINT) regarding threat actors, malicious infrastructure, and attack campaigns. It utilizes public data sources, passive reconnaissance tools (like WHOIS, Certificate Transparency), and specialized platforms (Maltego, Shodan, SpiderFoot) to map adversary context and perform pre-engagement intelligence gathering for authorized red team assessments. Emphasis is placed on passive collection techniques to ensure legality and operational security.

This guide outlines the process of passive external reconnaissance using Open Source Intelligence (OSINT) techniques. Users can map an organization's digital footprint by gathering comprehensive data, including DNS records, subdomains, certificate transparency logs, social media profiles, and leaked credentials. It is critical for the planning phase of penetration testing, asset mapping, or preparing for social engineering, all without actively interacting with target systems.

A comprehensive guide simulating real-world attacks against internet-facing infrastructure (firewalls, web servers, DNS, etc.). It covers the entire penetration testing lifecycle, including passive and active reconnaissance, vulnerability scanning (using tools like Nmap, Nessus, and Nuclei), manual validation, and simulated exploitation, adhering to standards like PTES and OSSTMM.

This comprehensive guide details how to perform thorough and passive subdomain enumeration using Subfinder. It is an essential process during the reconnaissance phase of penetration testing, bug bounty hunting, and security assessments. By integrating multiple passive sources (like Shodan, Censys, and Certificate Transparency logs), users can efficiently map the entire attack surface of a target organization, discover forgotten or misconfigured assets, and prepare for subsequent vulnerability scanning.

This comprehensive guide details the end-to-end process of conducting wireless security assessments. It covers passive reconnaissance, capturing WPA/WPA2 handshakes, cracking keys using Aircrack-ng and Hashcat, simulating Evil Twin attacks, detecting rogue access points, and testing network segmentation. It is essential for organizations validating their WiFi infrastructure security.

Methodology for passive Wi-Fi reconnaissance: choose compatible adapters, enable monitor mode, set regulatory domains, sweep 2.4/5/6 GHz bands, identify hidden SSIDs, clients, vendors, and encryption before active wireless attacks.