pentest-osint
Passive open-source intelligence on an authorized target: exposed subdomains and services, leaked credentials and secrets in public sources, employee and email enumeration, and accidental exposure, without touching the target. Read before passive intelligence gathering.
- License 许可
- Apache-2.0
- 所属仓库
- enowdev/enowxcli
- 最近更新
- 2026-10-06
- Stars
- ★ 67
- Forks
- 21
01 前言 Front Matter
- name
- pentest-osint
- description
- Passive open-source intelligence on an authorized target: exposed subdomains and services, leaked credentials and secrets in public sources, employee and email enumeration, and accidental exposure, without touching the target. Read before passive intelligence gathering.
03 SKILL.md 正文
OSINT (passive intelligence)
Passive means you do not touch the target: everything comes from third-party and public sources. It is the quietest stage and often the most revealing. Stay within what the engagement authorizes even here, enumerating a company's staff for a phishing narrative needs to be in scope.
What to gather
- Exposed infrastructure: subdomains and hosts from certificate transparency and passive DNS, without a single packet to the target.
- Leaked secrets: credentials, API keys and tokens in public code, paste sites, and breach corpora. Report by place and kind; never reuse a live credential.
- People and email: the email format, named employees, roles, the material a social-engineering test would build on.
- Accidental exposure: public buckets, misindexed documents, dorkable admin panels and backups.
Record what you find with where it came from, so the active stages can verify it. Hand anything that needs a probe to [[pentest-recon]].
04 同仓库更多 Skills
demo-skill
Project-scope demo skill for tests.
writing
Writing words people read: the specific thing instead of claims, words to drop, sentences, interface copy (buttons, labels, errors, empty states, confirmations), page copy, notifications and emails, alt text and link text, numbers and dates, words that translate well, documentation and voice. Read before writing a page's copy, an interface's text or a document.
ui
Designing or restyling an interface: direction, layout, type, colour, icons, components, states, responsive behaviour. Read before building a page, a screen or a set of components.
ui-themes
Light and dark themes, and colour that holds in both: tokens with a value per theme, and what each kind of content needs to stay visible (icons, SVG drawings and line art, logos, photos, screenshots, charts, code, maps, borders, shadows, focus, form controls), switching without a flash, and checking both. Read before building a second theme or a theme toggle, and before any drawing, logo or chart on a page that has two themes.
ui-structure
Structure before styling: the blueprint written before any interface code (the screen's job, the regions its kind of page needs, their order and why, the layout skeleton in numbers, the components and their states), the anatomy and order of a homepage, a dashboard, a list, a detail page, settings, a form, sign-in, pricing, docs, an article and a checkout, and how to turn the blueprint into code (tokens, layout primitives, components, sections, page). Read first, before building or rebuilding any page or screen.
ui-stack-vue
Building interfaces in Vue 3 and Nuxt: project layout, script setup with typed defineProps, defineEmits and defineModel, attribute fallthrough, slots and scoped slots, template refs, ref, reactive and computed, watch versus watchEffect, composables and VueUse, provide and inject, Pinia, keyed v-for, transitions, Nuxt 4 (app directory, pages, layouts, useFetch and useAsyncData keys, $fetch in handlers, server routes, runtime config, useSeoMeta, NuxtImg, middleware), VeeValidate forms, Reka UI and Nuxt UI, testing, vue-tsc, and the traps. Read when the project uses Vue or Nuxt.