/source-intelligence

name: source-intelligence
description: |
  This skill should be used when the user mentions "Google dork", "search operator", "inurl:", "filetype:", "intitle:", "site:", "intext:", "dork pattern", "breach forum", "BreachForums", "Exploit.in", "XSS.is", "RaidForums", "forum intelligence", "forum navigation", "seller credibility", "paste site", "Pastebin", "Ghostbin", "paste search", "paste monitoring", "Telegram leak", "Telegram channel", "Discord leak", "channel monitoring", "GitHub secrets", "GitHub scanning", "gitleaks", "trufflehog", "GitLab secrets", "committed credentials", "connection string leak", ".env file leak", "source discovery", "OSINT sources", "leak source", "intelligence gathering", "combolist", "combo list", "credential dump search", or discusses constructing search operator queries to find leaked data, navigating breach forums to locate target-specific listings, scanning paste sites for credentials or PII, monitoring Telegram/Discord channels for fresh leak announcements, scanning GitHub/GitLab repositories for committed secrets and connection strings, or evaluating the credibility of data sellers on underground forums. Always use this skill when the task involves discovering where target data has been leaked or exposed across web and underground sources — for instance, "find if anyone has posted their database on a forum" or "check GitHub for leaked connection strings" or "search paste sites for their credentials" should trigger this skill. It routes source intelligence through hunt-engine.js dork, github, and forum subcommands and logs discoveries via source-tracker.js.

Source Intelligence

Discover where target data has been leaked, exposed, or sold across search engines, code repositories, paste sites, breach forums, and messaging platforms. The goal is to build a complete map of available intelligence sources before any direct acquisition attempt.

Workflow

Source intelligence follows a structured collection process across five source categories. Work through each category systematically — skipping categories means missed intelligence.

SCOPE → DORK → CODE → PASTE → FORUM → CHAT → LOG → ROUTE
  │       │      │       │       │       │      │      │
  │       │      │       │       │       │      │      ├─ classified source → data-acquisition / cross-plugin-pipeline
  │       │      │       │       │       │      └─ source-tracker.js add + classify
  │       │      │       │       │       └─ Telegram/Discord channel monitoring
  │       │      │       │       └─ BreachForums, Exploit.in, XSS.is, dark web
  │       │      │       └─ Pastebin, paste.ee, Rentry, Ghostbin
  │       │      └─ GitHub/GitLab: hunt-engine.js github + gitleaks/trufflehog
  │       └─ Google/Brave dorks: hunt-engine.js dork
  └─ verify target is in-scope for the active engagement

---

Phase 1: Scope Verification

Before generating any queries:

1. Check `engagement.json` or the active campaign scope — confirm the target domain, brand name, and email patterns are authorized 2. Define search identifiers: primary domain (`corp.com`), brand name (`Acme Corp`), email pattern (`@corp.com`), product names, subsidiary domains 3. Check the active hunt profile — it determines which source categories are accessible

node ${CLAUDE_PLUGIN_ROOT}/scripts/hunt-profile.js show

| Profile | Dorks | Code | Paste | Forums | Chat | |---------|-------|------|-------|--------|------| | `surface` | Yes | Yes | Yes (via dorks) | No | No | | `deep` | Yes | Yes | Yes (direct) | Yes (registered accounts) | Yes (joined channels) | | `dark` | Yes | Yes | Yes (direct + Tor) | Yes (+ .onion forums) | Yes (+ hidden groups) | | `ghost` | Yes (paced) | Yes (paced) | Yes (Tor only) | Yes (single-threaded, max delays) | Yes (read-only) |

---

Phase 2: Google/Brave Dork Execution

Generate dork queries targeting the five discovery categories:

node ${CLAUDE_PLUGIN_ROOT}/scripts/hunt-engine.js dork <target> [--category exposed-db|credentials|dumps|configs|admin-panels]

Without `--category`, generates queries for all categories. Execute each generated query via Brave Search MCP tool.

Dork Categories

| Category | What It Finds | Priority | |----------|---------------|----------| | `credentials` | SQL dumps with passwords, paste site credential leaks, CSV/TXT with username:password | **Highest** — direct credential access | | `dumps` | Directory listings with database dumps, BSON/JSONL data files, breach references | High — raw data files | | `configs` | `.env` files with DB passwords, YAML/JSON configs with connection strings, Java properties with JDBC URLs | High — infrastructure credentials | | `exposed-db` | phpMyAdmin panels, Elasticsearch `_cat/indices`, Kibana dashboards, CouchDB Futon, Adminer | Medium — routes to exposed-databases skill | | `admin-panels` | Login panels, Grafana, Jenkins, RabbitMQ management interfaces | Lower — indirect value, may reveal infrastructure |

Execution Strategy

1. Start with `credentials` and `dumps` categories — these have the highest ROI for source discovery 2. Execute one dork at a time — search engines rate-limit automated queries 3. For each result page, check pages 2-3 as well — important results are often buried 4. Use `after:YYYY-MM-DD` date filter to surface recent leaks 5. If a result is deleted, try `cache:` operator or Wayback Machine to recover content 6. Archive paste/ephemeral content immediately before it disappears

Custom Dork Construction

When the generated dorks are not specific enough, build custom queries by combining operators:

**Target-specific credential hunt:**

("@DOMAIN" OR "BRAND") ("password" OR "senha" OR "pwd") (filetype:sql OR filetype:csv OR filetype:txt) -site:DOMAIN

**Infrastructure exposure sweep:**

("BRAND" OR "DOMAIN") (filetype:env OR filetype:conf OR filetype:yml OR filetype:ini) ("password" OR "secret" OR "key")

**Broad leak search:**

("@DOMAIN" "password") OR ("DOMAIN