Stats
Actions
Tags
Help us improve
Share bugs, ideas, or general feedback.
From cybersec-toolkit
Performs passive OSINT collection on threat actors and malicious infrastructure using Shodan, Maltego, certificate transparency logs, and WHOIS. Useful for red team pre-engagement recon and CTI report enrichment.
npx claudepluginhub 26zl/cybersec-toolkit --plugin cybersec-toolkitHow this skill is triggered — by the user, by Claude, or both
Slash command
/cybersec-toolkit:collecting-open-source-intelligenceThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Use this skill when:
Performs passive OSINT collection on threat actors and malicious infrastructure using Shodan, Maltego, certificate transparency logs, and WHOIS. Useful for red team pre-engagement recon and CTI report enrichment.
Collects and synthesizes OSINT on threat actors, malicious infrastructure, and attack campaigns using public sources, passive recon tools like Maltego/Shodan/SpiderFoot, and dark web monitoring. For authorized recon and CTI reports.
Collects OSINT on threat actors, malicious infrastructure, and attacks using passive tools like Maltego, Shodan, SpiderFoot. Useful for threat investigations, red team recon, and CTI reports.
Share bugs, ideas, or general feedback.
Use this skill when:
Do not use this skill for active scanning against targets without explicit written authorization — OSINT collection must remain passive (no packets sent to target systems) unless scope permits active recon.
Establish the intelligence requirement (IR) before collecting. Document:
# Passive DNS via SecurityTrails API
curl "https://api.securitytrails.com/v1/domain/evil-domain.com/dns/a" \
-H "apikey: YOUR_KEY"
# WHOIS history via ARIN / RIPE
whois -h whois.arin.net evil-domain.com
# Certificate transparency logs (no API key required)
curl "https://crt.sh/?q=%.evil-domain.com&output=json" | jq '.[].name_value'
Certificate transparency logs reveal all subdomains for a target domain, often exposing staging, VPN, or internal infrastructure inadvertently made public.
import shodan
api = shodan.Shodan("YOUR_SHODAN_API_KEY")
# Search for specific C2 framework signatures (Cobalt Strike beacon)
results = api.search('product:"Cobalt Strike" port:443')
for r in results['matches']:
print(r['ip_str'], r['port'], r['org'], r.get('ssl', {}).get('cert', {}).get('subject', ''))
# Find infrastructure associated with a known threat actor's ASN
results = api.search('asn:AS12345 http.title:"Redirector"')
Correlate Shodan results with passive DNS to build infrastructure clusters.
In Maltego, use these built-in transforms for threat actor infrastructure mapping:
Maltego Maltego Cyber threat intelligence transforms (VirusTotal, Shodan, PassiveTotal, URLScan) extend graph coverage.
Use SpiderFoot HX or manual searches for:
# SpiderFoot CLI for automated OSINT
python sf.py -s evil-domain.com -m sfp_shodan,sfp_virustotal,sfp_passivetotal \
-o TF -R result.json
| Term | Definition |
|---|---|
| Passive OSINT | Intelligence collection that does not send any packets to target systems — uses public databases, search engines, cached data |
| PIR | Priority Intelligence Requirement — specific question the intelligence collection must answer, preventing unfocused data gathering |
| Certificate Transparency | Public log of all SSL/TLS certificates issued by CAs, enabling discovery of subdomains via crt.sh |
| Pivoting | Using one data point (IP, email, registrant name) to discover related infrastructure or accounts |
| ASN | Autonomous System Number — block of IP addresses under a single routing policy; useful for clustering threat actor infrastructure |
| Co-hosted Domains | Multiple domains resolving to the same IP, potentially indicating shared attacker infrastructure |