offensive-osint-methodology
This Claude Code skill provides a structured framework for conducting open-source intelligence investigations, including target profiling, data collection workflows, timeline reconstruction, and reporting methodologies. Use it to guide systematic OSINT campaigns, teach intelligence gathering best practices, or track completion of reconnaissance tasks across multiple collection phases and sources.
git clone --depth 1 https://github.com/SnailSploit/Claude-Red /tmp/offensive-osint-methodology && cp -r /tmp/offensive-osint-methodology/Skills/recon/offensive-osint-methodology ~/.claude/skills/offensive-osint-methodologySKILL.md
# SKILL: OSINT Methodology ## Metadata - **Skill Name**: osint-methodology - **Folder**: offensive-osint-methodology - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/osint-method.md ## Description Structured OSINT methodology framework: target definition, source selection, collection workflows, data correlation, timeline reconstruction, and reporting. Use to guide systematic OSINT campaigns or teach OSINT methodology. ## Trigger Phrases Use this skill when the conversation involves any of: `OSINT methodology, open source intelligence, target profiling, data correlation, OSINT workflow, intelligence collection, OSINT campaign, recon methodology` ## Instructions for Claude When this skill is active: 1. Load and apply the full methodology below as your operational checklist 2. Follow steps in order unless the user specifies otherwise 3. For each technique, consider applicability to the current target/context 4. Track which checklist items have been completed 5. Suggest next steps based on findings --- ## Full Methodology # OSINT Methodology ## OpSec ### Create a Sock Puppet - Fake account that cannot be linked to you - Build a posting history (post stuff, etc.) - Resources - [Effective Sock Puppets](https://medium.com/@unseeable06/creating-an-effective-sock-puppet-for-your-osint-investigation-95fdbb8b075a) - [Ultimate Guide to Sock Puppets](https://osintteam.blog/the-ultimate-guide-to-sockpuppets-in-osint-how-to-create-and-utilize-them-effectively-d088c2ed6e36) - [Fake Name Generator](https://www.fakenamegenerator.com/) - [This Person does not Exist](https://thispersondoesnotexist.com/) - Use separate browser profiles or isolation tools (e.g., **Firefox Multi‑Account Containers**) for any sock‑puppet activity. - Acquire disposable VoIP/SMS numbers (e.g., **Burner**, **Silent Link**) to satisfy platform verification without exposing real phone numbers. - Audit every browser extension before installation; supply‑chain attacks on popular add‑ons have targeted investigators since 2024. - Use dedicated browser profiles/containers per case and persona; avoid logging into personal accounts. - Prefer hardware‑backed passkeys for critical accounts; store recovery codes offline. - Maintain a minimal chain‑of‑custody: timestamp actions, hash key artifacts, and record tool versions per case. ## Cryptocurrency Investigation ### Transaction Analysis - Track transaction flows between wallets - Identify clusters of related addresses - Monitor large transfers and whale activity - Use block explorers to trace fund movements - Tools: - Cielo: Multi-chain wallet tracking (EVM, Bitcoin, Solana, Tron) - TRM: Create relationship graphs for addresses/transactions - Arkham: Multichain explorer with entity labels, graph creation, and alerts - MetaSleuth: Transaction visualization for retail users - Range: CCTP bridge explorer - Socketscan: EVM bridge explorer - Pulsy: Bridge explorer aggregator - Chainalysis: **Horizon 2.0** cross‑chain tracing suite (paid) - Elliptic: **Lens** visual link explorer (launched Dec 2024) - Most compliance suites now provide **real‑time bridge‑risk scoring** dashboards (e.g., TRM, Chainalysis) #### Layer 2 / Rollup Analysis - **zkSync Era / Polygon zkEVM**: Zero-knowledge proofs hide transaction details on L2; only deposit/withdrawal bridge events visible on L1. Use [zkSync Era Block Explorer](https://explorer.zksync.io/) and [PolygonScan zkEVM](https://zkevm.polygonscan.com/). - **Arbitrum / Optimism**: Transactions batched and compressed; L2 state reconstructed from L1 calldata. Use [Arbiscan](https://arbiscan.io/) and [Optimistic Etherscan](https://optimistic.etherscan.io/). Check [L2Beat](https://l2beat.com/) for risk framework and technology stack. - **StarkNet**: Cairo VM with STARK proofs; different address derivation. Use [Voyager](https://voyager.online/) or [StarkScan](https://starkscan.co/). - **Base / Blast / Scroll**: OP Stack or ZK-rollups; similar challenges to above. - **Privacy protocols on L2**: - Aztec Network: Programmable privacy with noir circuits; limited block explorer visibility. - Railgun: Privacy system for DeFi on Ethereum/Polygon/BSC; shielded pools obscure sender/receiver/amount. - Privacy Pools: Proposed Tornado Cash successor with association sets; not yet deployed at scale. - **Challenges**: - Bridge mixers (Hop Protocol, Across, Stargate) create synthetic liquidity pools that break direct tracing; funds enter/exit via pool swaps. - Cross-rollup transfers further obfuscate trails; requires tracking via bridge contracts and relayer infrastructure. - Many L2s lack mature analytics tools; explorers show transactions but relationship graphs are sparse. - **Methodology**: - Start with L1 bridge events (deposits/withdrawals); these anchor L2 activity to known addresses. - Use L2-specific explorers to trace activity within the rollup. - For privacy protocols, focus on timing analysis, deposit/withdrawal clustering, and off-chain metadata (transaction memos, Tornado Cash-style notes). #### Cautions (bridges and heuristics) - Bridges/mixers/wrappers introduce mint/burn semantics; avoid assuming 1:1 flows without on‑chain proofs. - MEV/sandwich and aggregator paths can create false "direct" trails; validate with multiple datasets. - Cross‑label sanity: vendor labels can disagree; treat labels as hypotheses, not ground truth. - **L2 finality**: Optimistic rollups have 7-day challenge periods; zkRollups finalize faster but proofs can be batched/delayed. ### Wallet Profiling - Analyze wallet age and activity patterns - Check for connections to known entities - Monitor balance changes over time - Identify associated exchange accounts ### Exchange Investigation - Track deposits/withdrawals - Monitor trading patterns - Identify linked accounts - Check for regulatory compliance ### NFT Investigation - Track ownership history - Monitor sales and transfers - Analyze
Active Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential abuse (Kerberoasting, ASREProasting, NTLM relay, LLMNR/NBT-NS poisoning), privilege escalation (ACL abuse, GPO abuse, unconstrained/constrained delegation), lateral movement (Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, WMI/WinRM/PsExec), persistence (Golden/Silver/Diamond Tickets, DCSync, DCShadow, AdminSDHolder, Skeleton Key), forest trust attacks, ADCS abuse (ESC1-ESC15), and modern MDI/Defender for Identity evasion. Use when assessing on-prem AD, hybrid AD/Entra ID environments, or ADCS deployments.
Comprehensive red team operations methodology covering full engagement lifecycle from planning through reporting. Addresses engagement scoping and rules of engagement negotiation, multi-tier C2 infrastructure design with redirectors and domain fronting, malleable traffic profiles and beacon tradecraft, OPSEC discipline including attribution avoidance and indicator management, EDR and AMSI evasion techniques using direct syscalls and unhooking, data collection with chain-of-custody controls, and structured reporting with purple team debrief workflows. Covers assumed-breach, external-to-internal, insider threat, and hybrid physical-cyber engagement scenarios with MITRE ATT&CK mapping throughout. Targets operators planning or executing adversary simulation engagements against mature defenders.
Anti-forensics and evidence destruction techniques for red team operators conducting authorized engagements. Covers log clearing on Windows (wevtutil, Clear-EventLog, ETW provider patching) and Linux (journal truncation, utmp/wtmp binary editing, syslog manipulation), timestamp manipulation via Timestomp and SetMACE to defeat timeline analysis, filesystem-level anti-forensics including NTFS Alternate Data Streams for payload hiding and secure deletion with sdelete/shred, memory artifact removal to counter live forensics, disk artifact manipulation targeting MFT entries and USN journal records, network forensics evasion through encrypted C2 channels and DNS-over-HTTPS tunneling, and anti-VM/sandbox detection to avoid dynamic analysis environments. Tools: Timestomp, wevtutil, sdelete, shred, MimiPenguin, Invoke-Phant0m. Aligns to MITRE ATT&CK T1070 (Indicator Removal), T1027 (Obfuscated Files or Information), T1497 (Virtualization/Sandbox Evasion). Each technique includes the forensic artifact it targets, the destruction or manipulation method, and the defender perspective so operators understand detection gaps they must account for.
Advanced API exploitation methodology focused on business logic abuse and sophisticated attack patterns that bypass traditional security controls. Covers business logic bypass through API call chaining and workflow manipulation. Addresses GraphQL-specific attacks including batching for credential brute-force, query depth exploitation, and introspection abuse. Includes pagination exploitation for data exfiltration, webhook hijacking for SSRF and data interception, and resource exhaustion through algorithmic complexity attacks. Covers race conditions in API transactions using parallel request techniques. Provides comprehensive JWT manipulation including algorithm confusion, kid injection, jku/x5u abuse, and claim tampering. Details API key leakage detection across source repositories, client-side code, and error messages. Covers undocumented endpoint discovery through predictable naming, debug routes, and source map analysis. Tooling includes Arjun, ParamSpider, jwt_tool, and GraphQL Voyager. Designed for authorized penetration testers targeting business logic layers that automated scanners miss.
Comprehensive API security testing methodology covering REST, gRPC, and WebSocket attack surfaces. Addresses the full OWASP API Security Top 10 2023 including BOLA/IDOR, broken authentication, excessive data exposure, rate limiting bypass, BFLA, mass assignment, SSRF, and security misconfiguration. Includes REST-specific attacks such as HTTP verb tampering, content-type switching, and parameter pollution. Covers gRPC exploitation through protobuf interception, reflection API enumeration, and metadata injection. Addresses WebSocket vulnerabilities including origin bypass, message injection, and cross-site WebSocket hijacking. Provides tooling guidance for Burp Suite, Postman, grpcurl, websocat, and mitmproxy. Each technique includes detection signatures and defensive indicators so you understand what artifacts your testing leaves behind. Designed for authorized penetration testing engagements against API-driven architectures.
Bluetooth Low Energy (BLE) attack methodology — GATT enumeration, characteristic read/write without auth, pairing downgrade (Just Works forced), LE Secure Connections bypass, MITM via active relay, sniffing with Sniffle (TI CC1352) / Ubertooth / Frontline, encryption key extraction (LE Legacy Pairing crackable, LE Secure Connections strong), proximity authentication abuse (cars, locks), and companion-app trust analysis. Use for IoT BLE devices, smart locks, fitness trackers, medical devices, BLE beacons, or any device pairing over BLE.