recon

Name: recon
Author: briiirussell

132installs36forks

How to install recon?

briiirussell/cybersecurity-skills/recon

$npx -y skills add briiirussell/cybersecurity-skills --skill recon

Installs into the current project.

Summary

Perform structured reconnaissance and attack surface enumeration for authorized penetration tests, CTF challenges, and bug bounty programs. Use when the user mentions 'recon,' 'reconnaissance,' 'enumerate,' 'attack surface,' 'subdomain enumeration,' 'port scan,' 'fingerprint,' 'a

Files · 1

View on GitHub

SKILL.md

1	# Recon — Penetration Testing Reconnaissance
2
3	Perform structured reconnaissance against an authorized target, organizing findings into an actionable attack surface map.
4
5	Cross-references: `osint-recon` for the deeper open-source-intelligence pass (people, organizations, historical data) — this skill is the active/passive target-mapping side, osint-recon is the broader investigative side; they pair naturally. `web-pentest` for the next stage once recon has produced an attack surface map and an authorized target list. `owasp-audit` for source-code review when you have access to the target's code.
6
7	## Authorization Check
8
9	Before running any commands, confirm:
10	1. The user has written authorization for the target (pentest engagement, bug bounty program, CTF/lab environment)
11	2. The target is within the defined scope
12
13	If authorization is unclear, ask before proceeding. Never assume authorization.
14
15	## Methodology
16
17	### Phase 1: Passive Recon
18
19	Gather information without touching the target directly.
20
21	DNS enumeration:
22	- Run `dig any $ARGUMENTS` for A, AAAA, MX, TXT, NS, CNAME records
23	- Attempt zone transfer: `dig axfr @ns-server $ARGUMENTS`
24	- Enumerate subdomains via certificate transparency:
25	```
26	curl -s "https://crt.sh/?q=%25.$ARGUMENTS&output=json" \| jq -r '.[].name_value' \| sort -u
27	```
28
29	WHOIS and registration: Run `whois $ARGUMENTS` for registrant, nameserver, and creation date info.
30
31	Search engine dorking: Use targeted queries — `site:`, `inurl:`, `filetype:`, `intitle:` — to find exposed pages, documents, and admin panels.
32
33	Technology fingerprinting: Identify frameworks, CMS, server software, and JavaScript libraries from public-facing pages.
34
35	Public code repositories: Search GitHub/GitLab for the target's org name, domain, API keys, or internal paths.
36
37	Historical data: Check the Wayback Machine for old endpoints, removed pages, and configuration files.
38
39	### Phase 2: Active Recon (explicit authorization only)
40
41	Port scanning:
42	```bash
43	nmap -sC -sV -oN scan-results.txt $ARGUMENTS
44	```
45	Start with top 1000 ports. Expand to full range (`-p-`) if needed. Use `-Pn` if the host appears down but is in scope.
46
47	Service enumeration: Based on open ports, probe for version info and default configurations.
48
49	Web content discovery:
50	- Directory bruting with gobuster, feroxbuster, or dirsearch
51	- Virtual host enumeration
52	- API endpoint discovery (check `/api/`, `/v1/`, `/graphql`, `/swagger.json`)
53
54	SSL/TLS analysis: Run `testssl.sh` or `sslyze` to check for weak ciphers, expired certificates, and misconfigurations.
55
56	### Phase 3: Analysis
57
58	Correlate all findings. Identify the most promising attack vectors and prioritize by:
59	1. Severity of potential impact
60	2. Likelihood of exploitation
61	3. Exposure level (internet-facing vs. internal)
62
63	## Output Format
64
65	Produce a structured recon report:
66
67	```markdown
68	# Recon Report
69	## Target: [target]
70	## Scope: [confirmed scope]
71	## Date: [date]
72
73	### Passive Findings
74	\| Finding \| Details \| Relevance \|
75	\|---------\|---------\|-----------\|
76
77	### Subdomains Discovered
78	- [list]
79
80	### Technologies Detected
81	- [list with versions where identified]
82
83	### Active Findings
84	\| Port \| Service \| Version \| Notes \|
85	\|------\|---------\|---------\|-------\|
86
87	### Attack Surface Summary
88	[Prioritized list of interesting findings with risk assessment]
89
90	### Recommended Next Steps
91	[Ordered list of what to investigate further]
92	```
93
94	## Boundaries
95
96	- Stay within the defined scope — never scan adjacent or out-of-scope systems
97	- Rate-limit aggressive scans to avoid disruption
98	- Log all commands run for the engagement record
99	- If you discover evidence of active compromise by a third party, alert the user immediately
100	- Refuse requests targeting systems without explicit authorization
101	- Refuse requests for mass scanning of unrelated targets
102
103	## References
104
105	- PTES (Penetration Testing Execution Standard)
106	- OWASP Testing Guide
107	- Bug Bounty Methodology (jhaddix/tbhm)

People who liked this also viewed

6 picks

Type

recon

132installs36forks

View on GitHub

How to install recon?

briiirussell/cybersecurity-skills/recon

$npx -y skills add briiirussell/cybersecurity-skills --skill recon

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Recon — Penetration Testing Reconnaissance
2
3	Perform structured reconnaissance against an authorized target, organizing findings into an actionable attack surface map.
4
5	Cross-references: `osint-recon` for the deeper open-source-intelligence pass (people, organizations, historical data) — this skill is the active/passive target-mapping side, osint-recon is the broader investigative side; they pair naturally. `web-pentest` for the next stage once recon has produced an attack surface map and an authorized target list. `owasp-audit` for source-code review when you have access to the target's code.
6
7	## Authorization Check
8
9	Before running any commands, confirm:
10	1. The user has written authorization for the target (pentest engagement, bug bounty program, CTF/lab environment)
11	2. The target is within the defined scope
12
13	If authorization is unclear, ask before proceeding. Never assume authorization.
14
15	## Methodology
16
17	### Phase 1: Passive Recon
18
19	Gather information without touching the target directly.
20
21	DNS enumeration:
22	- Run `dig any $ARGUMENTS` for A, AAAA, MX, TXT, NS, CNAME records
23	- Attempt zone transfer: `dig axfr @ns-server $ARGUMENTS`
24	- Enumerate subdomains via certificate transparency:
25	```
26	curl -s "https://crt.sh/?q=%25.$ARGUMENTS&output=json" \| jq -r '.[].name_value' \| sort -u
27	```
28
29	WHOIS and registration: Run `whois $ARGUMENTS` for registrant, nameserver, and creation date info.
30
31	Search engine dorking: Use targeted queries — `site:`, `inurl:`, `filetype:`, `intitle:` — to find exposed pages, documents, and admin panels.
32
33	Technology fingerprinting: Identify frameworks, CMS, server software, and JavaScript libraries from public-facing pages.
34
35	Public code repositories: Search GitHub/GitLab for the target's org name, domain, API keys, or internal paths.
36
37	Historical data: Check the Wayback Machine for old endpoints, removed pages, and configuration files.
38
39	### Phase 2: Active Recon (explicit authorization only)
40
41	Port scanning:
42	```bash
43	nmap -sC -sV -oN scan-results.txt $ARGUMENTS
44	```
45	Start with top 1000 ports. Expand to full range (`-p-`) if needed. Use `-Pn` if the host appears down but is in scope.
46
47	Service enumeration: Based on open ports, probe for version info and default configurations.
48
49	Web content discovery:
50	- Directory bruting with gobuster, feroxbuster, or dirsearch
51	- Virtual host enumeration
52	- API endpoint discovery (check `/api/`, `/v1/`, `/graphql`, `/swagger.json`)
53
54	SSL/TLS analysis: Run `testssl.sh` or `sslyze` to check for weak ciphers, expired certificates, and misconfigurations.
55
56	### Phase 3: Analysis
57
58	Correlate all findings. Identify the most promising attack vectors and prioritize by:
59	1. Severity of potential impact
60	2. Likelihood of exploitation
61	3. Exposure level (internet-facing vs. internal)
62
63	## Output Format
64
65	Produce a structured recon report:
66
67	```markdown
68	# Recon Report
69	## Target: [target]
70	## Scope: [confirmed scope]
71	## Date: [date]
72
73	### Passive Findings
74	\| Finding \| Details \| Relevance \|
75	\|---------\|---------\|-----------\|
76
77	### Subdomains Discovered
78	- [list]
79
80	### Technologies Detected
81	- [list with versions where identified]
82
83	### Active Findings
84	\| Port \| Service \| Version \| Notes \|
85	\|------\|---------\|---------\|-------\|
86
87	### Attack Surface Summary
88	[Prioritized list of interesting findings with risk assessment]
89
90	### Recommended Next Steps
91	[Ordered list of what to investigate further]
92	```
93
94	## Boundaries
95
96	- Stay within the defined scope — never scan adjacent or out-of-scope systems
97	- Rate-limit aggressive scans to avoid disruption
98	- Log all commands run for the engagement record
99	- If you discover evidence of active compromise by a third party, alert the user immediately
100	- Refuse requests targeting systems without explicit authorization
101	- Refuse requests for mass scanning of unrelated targets
102
103	## References
104
105	- PTES (Penetration Testing Execution Standard)
106	- OWASP Testing Guide
107	- Bug Bounty Methodology (jhaddix/tbhm)

People who liked this also viewed

6 picks

Type