offensive-osint

Probe the 28 Swagger/OpenAPI paths and 13 GraphQL paths in the probes-and-wordlists reference against every alive webapp. For GraphQL, POST the standard introspection query; if introspection is disabled, fall back to field-suggestion enumeration with tools like Clairvoyance.

Use the 9 read-only validators in the secret-validators reference, covering AWS STS GetCallerIdentity, GitHub PAT scope headers, Slack auth.test, Postman, Anthropic, OpenAI, npm, Atlassian, and DataDog. Each call only reads account metadata and never modifies state.

The secret-patterns reference contains 48 regexes with severity and false-positive notes, including AKIA/ASIA prefixes for AWS keys and ghp_/github_pat_ prefixes for GitHub tokens. A stdlib-only Python scanner, secret_scan.py, mirrors the catalog and outputs JSONL findings.

No. The skill explicitly requires operator ownership or written authorization before use, and excludes active exploitation, post-exploitation, and defensive detection content. It is scoped strictly to reconnaissance on authorized assets.

Apply the 0-100 endpoint interest rubric: unauthenticated write methods add 40 points, open GraphQL introspection 35, reflected CORS with credentials 25, and so on. Scores of 90 or above map to CRITICAL, 70-89 to HIGH, with an attack-path hint attached for high scores.

The free Cavalier API returns counts and sample URLs only, redacts subdomain hostnames with asterisks, never exposes cleartext passwords, and rate-limits to roughly one request per second per IP. Unredacted credentials and bulk enumeration require the paid tier.