domain-intel

1---2name: domain-intel3description: Passive recon of subdomains, SSL certs, WHOIS, and DNS.4version: 1.0.05author: FurkanL0, Hermes Agent6license: MIT7platforms: [linux, macos, windows]8metadata:9  hermes:10    tags: [Domains, OSINT, DNS, Research]11    related_skills: []12---13 14# Domain Intelligence — Passive OSINT15 16Passive domain reconnaissance using only Python stdlib.17**Zero dependencies. Zero API keys. Works on Linux, macOS, and Windows.**18 19## Helper script20 21This skill includes `scripts/domain_intel.py` — a complete CLI tool for all domain intelligence operations.22 23```bash24# Subdomain discovery via Certificate Transparency logs25python SKILL_DIR/scripts/domain_intel.py subdomains example.com26 27# SSL certificate inspection (expiry, cipher, SANs, issuer)28python SKILL_DIR/scripts/domain_intel.py ssl example.com29 30# WHOIS lookup (registrar, dates, name servers — 100+ TLDs)31python SKILL_DIR/scripts/domain_intel.py whois example.com32 33# DNS records (A, AAAA, MX, NS, TXT, CNAME)34python SKILL_DIR/scripts/domain_intel.py dns example.com35 36# Domain availability check (passive: DNS + WHOIS + SSL signals)37python SKILL_DIR/scripts/domain_intel.py available coolstartup.io38 39# Bulk analysis — multiple domains, multiple checks in parallel40python SKILL_DIR/scripts/domain_intel.py bulk example.com github.com google.com41python SKILL_DIR/scripts/domain_intel.py bulk example.com github.com --checks ssl,dns42```43 44`SKILL_DIR` is the directory containing this SKILL.md file. All output is structured JSON.45 46## Available commands47 48| Command | What it does | Data source |49|---------|-------------|-------------|50| `subdomains` | Find subdomains from certificate logs | crt.sh (HTTPS) |51| `ssl` | Inspect TLS certificate details | Direct TCP:443 to target |52| `whois` | Registration info, registrar, dates | WHOIS servers (TCP:43) |53| `dns` | A, AAAA, MX, NS, TXT, CNAME records | System DNS + Google DoH |54| `available` | Check if domain is registered | DNS + WHOIS + SSL signals |55| `bulk` | Run multiple checks on multiple domains | All of the above |56 57## When to use this vs built-in tools58 59- **Use this skill** for infrastructure questions: subdomains, SSL certs, WHOIS, DNS records, availability60- **Use `web_search`** for general research about what a domain/company does61- **Use `web_extract`** to get the actual content of a webpage62- **Use `terminal` with `curl -I`** for a simple "is this URL reachable" check63 64| Task | Better tool | Why |65|------|-------------|-----|66| "What does example.com do?" | `web_extract` | Gets page content, not DNS/WHOIS data |67| "Find info about a company" | `web_search` | General research, not domain-specific |68| "Is this website safe?" | `web_search` | Reputation checks need web context |69| "Check if a URL is reachable" | `terminal` with `curl -I` | Simple HTTP check |70| "Find subdomains of X" | **This skill** | Only passive source for this |71| "When does the SSL cert expire?" | **This skill** | Built-in tools can't inspect TLS |72| "Who registered this domain?" | **This skill** | WHOIS data not in web search |73| "Is coolstartup.io available?" | **This skill** | Passive availability via DNS+WHOIS+SSL |74 75## Platform compatibility76 77Pure Python stdlib (`socket`, `ssl`, `urllib`, `json`, `concurrent.futures`).78Works identically on Linux, macOS, and Windows with no dependencies.79 80- **crt.sh queries** use HTTPS (port 443) — works behind most firewalls81- **WHOIS queries** use TCP port 43 — may be blocked on restrictive networks82- **DNS queries** use Google DoH (HTTPS) for MX/NS/TXT — firewall-friendly83- **SSL checks** connect to the target on port 443 — the only "active" operation84 85## Data sources86 87All queries are **passive** — no port scanning, no vulnerability testing:88 89- **crt.sh** — Certificate Transparency logs (subdomain discovery, HTTPS only)90- **WHOIS servers** — Direct TCP to 100+ authoritative TLD registrars91- **Google DNS-over-HTTPS** — MX, NS, TXT, CNAME resolution (firewall-friendly)92- **System DNS** — A/AAAA record resolution93- **SSL check** is the only "active" operation (TCP connection to target:443)94 95## Notes96 97- WHOIS queries use TCP port 43 — may be blocked on restrictive networks98- Some WHOIS servers redact registrant info (GDPR) — mention this to the user99- crt.sh can be slow for very popular domains (thousands of certs) — set reasonable expectations100- The availability check is heuristic-based (3 passive signals) — not authoritative like a registrar API101 102---103 104*Contributed by [@FurkanL0](https://github.com/FurkanL0)*105