Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →Comprehensive OSINT methodology skill for offensive security, red team intelligence gathering, and bug bounty reconnaissance. Covers domain recon, email harvesting, social media profiling, GitHub/code leaks, Shodan/Censys enumeration, breach data lookup, employee profiling, infrastructure mapping, cryptocurrency tracing, geospatial intelligence, and AI-assisted analysis workflows. Use when performing reconnaissance against a target domain or organization, investigating a person or entity, tracin
| Test case | Without → With | Effect | Δ tokens | Δ turns |
|---|---|---|---|---|
| case-01 | ✗→✓ | ▲ Improved | 232% | 0% |
| case-03 | ✗→✓ | ▲ Improved | 245% | 0% |
| case-04 | ✗→✓ | ▲ Improved | 179% | 0% |
| case-09 | ✗→✓ | ▲ Improved | 714% | 0% |
| case-05 | ✓→✓ | ＝ Same ✓ | 233% | 0% |
run_id and tool versions for reproducibility| Tool | Notes | |------|-------| | Carrot2 | Clusters results by topic | | etools | Metasearch engine | | Kagi | Privacy-first, non-personalized results | | Brave Search | Independent index; Goggles for custom ranking | | PDF Search | Search PDF files and view table of contents | | Google Fact Check Explorer | Cross-site fact-check search |
| Tool | Purpose | |------|---------| | Sherlock | Username search across social networks | | Maigret | Collect profiles by username from many sites | | What's My Name | Username search across platforms | | Holehe | Check if email is registered on platforms | | Epieos | Email address pivots and metadata | | OSINT Industries | Email/username/phone lookups | | Hunter.io | Find email addresses for a domain | | EmailRep | Email reputation and associated data | | Emailable | Verify email existence | | Mugetsu | X/Twitter username history | | RocketReach / Apollo | Email enrichment and pattern guessing | | PhoneInfoga | Phone number intelligence framework |
Browser extensions: GetProspect, SignalHire
| Platform | Tool | |----------|------| | Instagram | Picuki — view profiles without account | | X/Twitter | snscrape — preferred CLI scraper; use Twint only as fallback | | Facebook | Graph Search, sowsearch.info, lookup-id.com, whopostedwhat.com | | Facebook (research) | Meta Content Library — CrowdTangle successor (researcher-gated) | | YouTube/Twitch | Social Blade — analytics | | TikTok | Tokboard — trend and profile analytics | | Reddit | Reveddit — removed content; RedTrack.social — user history | | Bluesky | Firesky — real-time firehose; SkyView — follower graphs | | Mastodon | FediSearch — cross-instance search; Fedifinder — find Twitter users on Mastodon | | Faces | Search4Faces |
Russia: Rusprofile, Kontur.Focus (freemium), zakupki.gov.ru (procurement), EGRUL/EGRIP (official, captcha-gated)
China: GSXT (National Enterprise Credit), Qichacha/Tianyancha (freemium), MIIT ICP/Beian (ICP filings)
| Chain | Explorer | |-------|---------| | Bitcoin | Blockchain.com, Blockchair | | Ethereum | Etherscan | | BNB Chain | BSCScan | | Polygon PoS | PolygonScan | | Solana | Solscan | | Multi-chain | OKLink Freemium], Cielo |
L2 Explorers: Arbiscan, Optimistic Etherscan, BaseScan, zkSync Era, L2Beat (risk/TVL comparison)
Street View: Google Street View, Apple Maps, Yandex Maps, Baidu Maps
> Warning: Never paste PII, sensitive IOCs, or unique pivots into cloud LLMs. They log inputs and may use them for training. Use local models (Ollama, LM Studio) for sensitive analysis.
| Tool | Strength | |------|---------| | ChatGPT (paid) | Log parsing, dataset analysis, Code Interpreter for CSVs/JSON, GPT-4 Vision for image OCR | | Claude (paid) | 200K token context for large document dumps and report synthesis | | Gemini 1.5 Pro | 2M token context; Deep Research mode with citations | | Perplexity Pro (paid) | Real-time web search + reasoning; multi-query synthesis |
Local/privacy-preserving: Ollama (Llama 3, Mistral), LM Studio, GPT4All
Evidence handling:
run_id and tool versions for reproducibilityhttps://t.me/s/<channel>Other measured skills in the registry, with their headline benchmark lift.