Usage Guide - SpecterOps Open Source

Getting Started

After installing Ghost Scout, you can begin your reconnaissance workflow. The application provides a web interface accessible at http://localhost:3000.

Typical Workflow

Ghost Scout follows a sequential workflow for building phishing campaigns:

Add Target Domain

Navigate to the Domains page and add your target company’s domain

Enter the domain (e.g., example.com)
Ghost Scout will store the domain and prepare for reconnaissance
DNS records will be queued for lookup

Start Reconnaissance

Initiate Hunter.io search to find employees and email formats

Click “Start Reconnaissance” for the target domain
Hunter.io API will search for email addresses
Email format patterns will be identified
Discovered contacts will be stored in the database
Real-time updates will show progress

Scrape Sources

Enrich contact information by scraping discovered URLs

Review discovered sources for each contact
Select sources to scrape for additional information
HTML content will be converted to Markdown
Source data will be associated with contacts
Enriched profiles will include scraped content

Generate Profiles

Use AI to generate detailed profiles for discovered contacts

Select contacts for profile generation
Anthropic API will analyze scraped data
AI will generate structured profiles
Profiles include key information and context
Review generated profiles for accuracy

Create Pretexts

Generate personalized phishing emails for each target

Select targets for pretext generation
Choose prompt template from library
AI generates personalized pretexts
Review generated emails for quality
Edit pretexts as needed

Review & Export

Review, approve, and export pretexts for your campaign

Review all generated pretexts
Make final edits and approvals
Export for use in phishing infrastructure
Track which pretexts have been used

Feature Usage

Domain Management

Add Domain
View DNS Records
Related Domains

Adding a Target Domain:

Navigate to the Domains page
Click “Add Domain”
Enter the target domain (without http:// or www)
Click “Submit”

Example:

Domain: targetcompany.com

Ghost Scout will:

Store the domain in the database
Queue DNS lookups (MX, SPF, DMARC records)
Prepare for reconnaissance activities

Reconnaissance

Start Reconnaissance
Monitor Progress
Review Contacts

Initiating Hunter.io Search:

Select a domain from your list
Click “Start Reconnaissance”
Monitor real-time progress updates

What Happens:

Hunter.io API searches for email addresses at the domain
Email format patterns are identified (e.g., {first}.{last}@domain.com)
Discovered contacts are stored with available information
Sources (LinkedIn, company websites, etc.) are recorded
Real-time updates show discovered contacts

Source Scraping

Select Sources
Scraping Process
Review Scraped Data

Choosing Sources to Scrape:

Navigate to a contact’s detail page
Review discovered sources (URLs)
Select sources likely to contain useful information
Click “Scrape Selected”

Source Types:

LinkedIn profiles
Company bios
Blog posts
Social media profiles
Company directories

Profile Generation

Generate Profiles
Profile Quality
Edit Profiles

Creating AI Profiles:

Select contacts with scraped data
Click “Generate Profiles”
Monitor queue processing
Review generated profiles

Profile Contents:

Professional background
Role and responsibilities
Interests and activities
Public information summary
Context for personalization

Factors Affecting Quality:

Source Data: More scraped sources = better profiles
Source Quality: Professional profiles better than brief mentions
Prompt Templates: Customize prompts in prompt_library/
LLM Model: Anthropic Claude quality affects output

Best Practices:

Scrape multiple sources per target
Use high-quality sources (LinkedIn, company bios)
Review and edit profiles as needed

Pretext Generation

Choose Template
Generate Pretexts
Review & Edit

Selecting Prompt Templates:Ghost Scout includes templates in prompt_library/:

IT support pretexts
HR/benefits pretexts
Executive communication pretexts
Vendor/partner pretexts
Security awareness pretexts

Choose templates that match your campaign goals.

Export & Campaign Management

Export Pretexts
Track Usage
Data Management

Exporting for Campaigns:Export pretexts for use in phishing tools:

CSV format with target information
Individual email templates
Bulk export functionality

Use exported data in your phishing infrastructure.

Operational Scenarios

Scenario 1: Broad Company Reconnaissance

Goal: Discover as many employees as possible at a target organization

Add Primary Domain

Domain: targetcompany.com

Start Reconnaissance

Let Hunter.io discover all available contacts at the domain

Identify Related Domains

Check for:

Subsidiary domains
Regional domains
Acquired company domains

Expand Reconnaissance

Add and search related domains for additional contacts

Prioritize Targets

Review all discovered contacts and select high-value targets:

Executive leadership
IT administrators
Finance personnel
HR staff

Scenario 2: Targeted Spear Phishing

Goal: Create highly personalized pretexts for specific individuals

Identify Targets

Use Hunter.io to find specific individuals:

C-level executives
Department heads
Project managers

Comprehensive Source Scraping

Scrape multiple sources per target:

LinkedIn profiles
Company bios
Conference presentations
Blog posts
Social media

Generate Detailed Profiles

Create rich profiles with extensive information

Custom Pretexts

Generate pretexts referencing:

Recent activities
Professional interests
Current projects
Industry trends relevant to target

Manual Refinement

Carefully edit pretexts for maximum believability

Scenario 3: Campaign Template Development

Goal: Develop reusable pretext templates for multiple campaigns

Research Multiple Organizations

Conduct reconnaissance on several similar organizations

Identify Common Patterns

Find patterns across organizations:

Similar roles
Common workflows
Industry-specific language
Shared pain points

Create Template Pretexts

Develop pretext templates that work across targets:

Generic IT support scenarios
Common HR/benefits topics
Industry-standard processes

Customize Per Campaign

For each engagement, personalize templates with:

Organization-specific details
Target-specific information
Current events/context

OPSEC Best Practices

Follow operational security best practices to avoid detection

Hunter.io Usage

API Key Management

Use dedicated API keys for operations
Avoid personal/company accounts
Consider disposable accounts for sensitive engagements
Rotate keys between campaigns
Monitor API usage and rate limits

Search Patterns

Be aware Hunter.io may notify target organizations
Space out searches over time
Avoid rapid sequential searches
Consider search volume limits
Document search timestamps

Attribution

Hunter.io searches can be attributed to your account
Target organizations may receive alerts
Consider using separate accounts per client
Be prepared to explain reconnaissance activities
Maintain engagement documentation

Infrastructure Security

Network Isolation

Deploy Ghost Scout on isolated infrastructure
Use VPN or dedicated network for operations
Separate infrastructure per engagement
Avoid using organizational networks
Consider cloud-based deployments

Data Security

Encrypt SQLite database files
Secure Redis instance with passwords
Limit access to Ghost Scout interface
Implement authentication and access control
Backup data securely

Operational Hygiene

Clean up data between engagements
Delete reconnaissance data after campaigns
Maintain separate instances per client
Document data retention policies
Secure API keys and credentials

Content Generation

AI-Generated Content

Review all AI-generated content carefully
Watch for AI artifacts and inconsistencies
Verify personalized details are accurate
Ensure realistic tone and style
Edit for natural language

Personalization Accuracy

Verify scraped information is current
Check that details match target’s reality
Avoid outdated or incorrect information
Cross-reference multiple sources
Update profiles as needed

Template Management

Customize prompt templates for each engagement
Test templates with sample data
Iterate based on campaign results
Document effective templates
Maintain template library

Automation Examples

Bulk Profile Generation

# Example: Generate profiles for all contacts without profiles
# This would be done through the web interface, but can be scripted

# 1. Query database for contacts without profiles
# 2. Ensure sources are scraped
# 3. Queue profile generation jobs
# 4. Monitor queue progress
# 5. Review generated profiles

Scheduled Reconnaissance

# Example: Scheduled reconnaissance for ongoing monitoring
# Use cron or scheduled task to periodically update reconnaissance

# Crontab entry (daily reconnaissance at 2 AM)
0 2 * * * cd /path/to/ghost_scout && node scripts/scheduled-recon.js

Export Automation

# Example: Automated export of completed pretexts
# Export pretexts as they're approved for campaign use

# Script to export approved pretexts to campaign infrastructure
node scripts/export-pretexts.js --status=approved --format=csv --output=/path/to/campaign/

Troubleshooting

No Contacts Found

Possible Causes:

Hunter.io has no data for the domain
Domain spelling error
Private/small organization
API key issues

Solutions:

Verify domain spelling
Check Hunter.io directly for domain data
Try related domains
Verify API key is valid
Check Hunter.io account status

Scraping Failures

Possible Causes:

Source URL is behind authentication
Source has anti-scraping protections
MarkItDown-API connection issues
Rate limiting by source site

Solutions:

Verify MarkItDown-API is running
Check source URL is accessible
Space out scraping requests
Skip protected sources
Manual data collection for important sources

Profile Generation Errors

Possible Causes:

Insufficient scraped data
Anthropic API key issues
API rate limits
Prompt template errors

Solutions:

Scrape more sources for the target
Verify Anthropic API key
Check API usage and limits
Review prompt template syntax
Monitor job queue for errors

Pretext Quality Issues

Possible Causes:

Low-quality profile data
Inappropriate template selection
Prompt needs customization
LLM hallucination

Solutions:

Improve profile quality with better sources
Choose more appropriate template
Customize prompt templates
Manually edit generated pretexts
Provide more context in prompts

Real-time Updates Not Working

Possible Causes:

Socket.io connection issues
Redis connection problems
Job queue not processing
Client-side JavaScript errors

Solutions:

Check browser console for errors
Verify Redis is running
Check Socket.io connection status
Restart Ghost Scout application
Clear browser cache and reload

Best Practices

Reconnaissance

Start Broad

Begin with company-wide reconnaissance to identify all potential targets

Then Focus

Narrow down to high-value targets for detailed profiling

Multiple Sources

Scrape multiple sources per target for comprehensive profiles

Verify Information

Cross-reference information across sources for accuracy

Profile & Pretext Generation

Quality Over Quantity

Better to have fewer high-quality pretexts than many poor ones

Manual Review

Always review AI-generated content before use

Iterate Templates

Improve prompt templates based on campaign results

Test Pretexts

Test pretexts on internal team before deploying

Campaign Management

Document Everything

Keep detailed records of reconnaissance and campaigns

Track Results

Monitor campaign effectiveness and iterate

Secure Data

Protect reconnaissance data and pretexts

Clean Up

Delete data after engagement completion

Next Steps

Overview

Learn about Ghost Scout features

Installation

Setup and installation guide

Hunter.io API

Hunter.io API documentation

​Getting Started

​Typical Workflow

​Feature Usage

​Domain Management

​Reconnaissance

​Source Scraping

​Profile Generation

​Pretext Generation

​Export & Campaign Management

​Operational Scenarios

​Scenario 1: Broad Company Reconnaissance

​Scenario 2: Targeted Spear Phishing

​Scenario 3: Campaign Template Development

​OPSEC Best Practices

​Hunter.io Usage

​Infrastructure Security

​Content Generation

​Automation Examples

​Bulk Profile Generation

​Scheduled Reconnaissance

​Export Automation

​Troubleshooting

​Best Practices

​Reconnaissance

Start Broad

Then Focus

Multiple Sources

Verify Information

​Profile & Pretext Generation

Quality Over Quantity

Manual Review

Iterate Templates

Test Pretexts

​Campaign Management

Document Everything

Track Results

Secure Data

Clean Up

​Next Steps

Overview

Installation

Hunter.io API

Getting Started

Typical Workflow

Feature Usage

Domain Management

Reconnaissance

Source Scraping

Profile Generation

Pretext Generation

Export & Campaign Management

Operational Scenarios

Scenario 1: Broad Company Reconnaissance

Scenario 2: Targeted Spear Phishing

Scenario 3: Campaign Template Development

OPSEC Best Practices

Hunter.io Usage

Infrastructure Security

Content Generation

Automation Examples

Bulk Profile Generation

Scheduled Reconnaissance

Export Automation

Troubleshooting

Best Practices

Reconnaissance

Profile & Pretext Generation

Campaign Management

Next Steps