offensive-osint

High-risk dual-use offensive-security skill: its broad reconnaissance and attack-path capabilities are coherent with its stated red-team purpose, but the explicit handoffs to exploitation skills materially extend the potential impact. The excerpt shows no confirmed credential theft, exfiltration, or malicious installer; the missing reference files prevent full review of tooling and data flows.

This fragment is a credential-driven, multi-platform reconnaissance and token-triage playbook. It uses embedded/authenticated tokens to enumerate AWS IAM capabilities and logging/MFA posture, discover secret-relevant identifiers (AWS Secrets Manager/SSM, GitHub secrets metadata, Postman environment values), enumerate Slack private channels/users, and inventory accessible GitHub org/repo scope. It additionally includes explicit JWT attack testing steps (alg=none, RS→HS algorithm confusion, and HS256 brute-force guidance). No on-host malware/persistence is visible, but the operational intent and methods indicate malicious credential abuse and compromise preparation, resulting in an extremely high security risk if found in a dependency or distributed script.

No embedded malicious code is evidenced in this fragment (it is instructional documentation rather than a functioning dependency module with runtime compromise behavior). However, it directly enables offensive reconnaissance and targeted email list creation by combining breach/infostealer corpus queries, DNS posture inference for SSO exposure escalation, and email harvesting/pattern inference from multiple public sources and scraped content. If distributed as part of a package, treat it as high dual-use/misuse risk rather than supply-chain malware, and review intended use controls and scope.

The provided content is not a software dependency module; it is an attacker-style reconnaissance and identifier-extraction workflow. It enables collection of sensitive security-relevant identifiers (AWS account IDs, OAuth client IDs/scopes), Microsoft 365 tenant/provisioning and potential exposure indicators, and GraphQL schema/field discovery via error/suggestion probing. While it contains no evidence of executable supply-chain malware itself, the operational guidance is strongly malicious in intent and materially increases the capability for targeted intrusion and data exposure.

This code fragment is not overtly malicious by itself, but it creates a high-impact security risk: it exposes unauthenticated HTTP endpoints that can trigger scanning of arbitrary existing filesystem paths supplied by a client and return the scan findings over the network. Additionally, it imports a local secret_scan module and runs a bundled helper script via subprocess with request-derived arguments, both of which are major opaque trust boundaries. If the service is reachable beyond a trusted local environment, it can enable unintended sensitive local data disclosure through the scan results.