recon-dominator

Name: recon-dominator
Author: Orizon-eu

18stars4forks

How to install recon-dominator?

orizon-eu/claude-code-pentest/recon-dominator

$npx -y skills add Orizon-eu/claude-code-pentest --skill recon-dominator

Installs into the current project.

Summary

Automated full-scope reconnaissance starting from a domain or domain list. Performs subdomain enumeration, port scanning, technology fingerprinting, OSINT correlation, Google dorking, and Wayback analysis. Use when user provides a domain or list of domains and asks for "recon", "

Files · 1

View on GitHub

SKILL.md

1	# Recon Dominator
2
3	Full-scope reconnaissance orchestrator. From a single domain to a complete attack surface map.
4
5	## Important
6
7	CRITICAL: Only use on domains you have explicit authorization to test. Verify scope before every engagement.
8
9	## Instructions
10
11	### Step 1: Scope Validation
12	Before ANY reconnaissance activity:
13	1. Ask the user to confirm they have written authorization to test the target domain(s)
14	2. Confirm the scope boundaries (wildcard subdomains? specific IPs only? out-of-scope assets?)
15	3. Document the scope in the output
16
17	### Step 2: Passive Subdomain Enumeration
18	Run passive enumeration first (no direct contact with target):
19
20	```bash
21	python scripts/passive_recon.py --domain {target_domain}
22	```
23
24	This collects subdomains from:
25	- Certificate Transparency logs (crt.sh)
26	- DNS datasets (SecurityTrails, DNSDumpster)
27	- Search engine results
28	- Wayback Machine archives
29
30	Expected output: JSON list of discovered subdomains with source attribution.
31
32	### Step 3: Active Subdomain Enumeration
33	After passive phase, run active enumeration:
34
35	```bash
36	python scripts/active_recon.py --domain {target_domain} --wordlist references/subdomains-wordlist.txt
37	```
38
39	This performs:
40	- DNS brute-force with common subdomain wordlist
41	- DNS zone transfer attempts
42	- Virtual host discovery
43	- Permutation/alteration scanning (dev-, staging-, api-, etc.)
44
45	### Step 4: Live Host Detection and Port Scanning
46
47	```bash
48	python scripts/port_scanner.py --input {subdomains_file} --top-ports 1000
49	```
50
51	For each live subdomain:
52	1. HTTP/HTTPS probe (status codes, redirects, titles)
53	2. Top 1000 port scan with service version detection
54	3. Banner grabbing on open ports
55	4. WAF/CDN detection (Cloudflare, Akamai, AWS CloudFront)
56
57	### Step 5: Technology Fingerprinting
58
59	```bash
60	python scripts/tech_fingerprint.py --input {live_hosts_file}
61	```
62
63	Detect:
64	- Web server (Apache, Nginx, IIS, etc.)
65	- Programming language/framework (PHP, Django, Rails, Spring, etc.)
66	- CMS (WordPress, Drupal, Joomla)
67	- JavaScript frameworks (React, Angular, Vue)
68	- Third-party services and integrations
69	- HTTP security headers (or lack thereof)
70
71	### Step 6: OSINT Correlation
72
73	```bash
74	python scripts/osint_correlator.py --domain {target_domain}
75	```
76
77	Gather:
78	- WHOIS history and registrant patterns
79	- ASN mapping and IP range ownership
80	- Reverse IP lookups (shared hosting)
81	- Email addresses associated with the domain
82	- Social media and GitHub references
83	- Leaked credentials databases (public sources only)
84
85	### Step 7: Google Dorking
86
87	```bash
88	python scripts/google_dorker.py --domain {target_domain} --dork-file references/dorks-database.txt
89	```
90
91	Automated searches for:
92	- Exposed files: `site:{domain} filetype:pdf\|doc\|xls\|sql\|bak\|log\|env`
93	- Login panels: `site:{domain} inurl:admin\|login\|dashboard`
94	- Directory listings: `site:{domain} intitle:"index of"`
95	- Error messages: `site:{domain} "sql syntax" \| "warning" \| "error"`
96	- Sensitive endpoints: `site:{domain} inurl:api\|graphql\|swagger\|config`
97
98	### Step 8: Wayback Machine Analysis
99
100	```bash
101	python scripts/wayback_analyzer.py --domain {target_domain}
102	```
103
104	Extract:
105	- Historical endpoints no longer linked but still active
106	- Removed pages with sensitive information
107	- Old API versions still responding
108	- Parameter names from archived URLs
109	- JavaScript files with hardcoded secrets
110
111	### Step 9: Output Generation
112	Compile all findings into a structured report:
113
114	```bash
115	python scripts/generate_report.py --project {project_name}
116	```
117
118	Output format:
119	1. Executive Summary: domain count, subdomain count, live hosts, open ports, technologies
120	2. Asset Inventory: full list with metadata per asset
121	3. Technology Matrix: tech stack per subdomain
122	4. Potential Entry Points: ranked by interest level
123	5. Relationship Graph: JSON graph of domain relationships
124	6. Raw Data: all collected data in JSON for pipeline consumption
125
126	## Output Files Structure
127	```
128	output/{project_name}/
129	summary.md # Human-readable report
130	assets.json # Full asset inventory
131	subdomains.json # All discovered subdomains
132	ports.json # Port scan results
133	technologies.json # Tech fingerprinting
134	osint.json # OSINT findings
135	wayback.json # Historical data
136	graph.json # Relationship graph
137	dorking_results.json # Google dork findings
138	```
139
140	## Error Handling
141
142	### Common Issues
143
144	#### Rate Limiting on External APIs
145	If you see "429 Too Many Requests":
146	1. The scripts have built-in rate l

People who liked this also viewed

6 picks

Type

recon-dominator

18stars4forks

View on GitHub

How to install recon-dominator?

orizon-eu/claude-code-pentest/recon-dominator

$npx -y skills add Orizon-eu/claude-code-pentest --skill recon-dominator

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Recon Dominator
2
3	Full-scope reconnaissance orchestrator. From a single domain to a complete attack surface map.
4
5	## Important
6
7	CRITICAL: Only use on domains you have explicit authorization to test. Verify scope before every engagement.
8
9	## Instructions
10
11	### Step 1: Scope Validation
12	Before ANY reconnaissance activity:
13	1. Ask the user to confirm they have written authorization to test the target domain(s)
14	2. Confirm the scope boundaries (wildcard subdomains? specific IPs only? out-of-scope assets?)
15	3. Document the scope in the output
16
17	### Step 2: Passive Subdomain Enumeration
18	Run passive enumeration first (no direct contact with target):
19
20	```bash
21	python scripts/passive_recon.py --domain {target_domain}
22	```
23
24	This collects subdomains from:
25	- Certificate Transparency logs (crt.sh)
26	- DNS datasets (SecurityTrails, DNSDumpster)
27	- Search engine results
28	- Wayback Machine archives
29
30	Expected output: JSON list of discovered subdomains with source attribution.
31
32	### Step 3: Active Subdomain Enumeration
33	After passive phase, run active enumeration:
34
35	```bash
36	python scripts/active_recon.py --domain {target_domain} --wordlist references/subdomains-wordlist.txt
37	```
38
39	This performs:
40	- DNS brute-force with common subdomain wordlist
41	- DNS zone transfer attempts
42	- Virtual host discovery
43	- Permutation/alteration scanning (dev-, staging-, api-, etc.)
44
45	### Step 4: Live Host Detection and Port Scanning
46
47	```bash
48	python scripts/port_scanner.py --input {subdomains_file} --top-ports 1000
49	```
50
51	For each live subdomain:
52	1. HTTP/HTTPS probe (status codes, redirects, titles)
53	2. Top 1000 port scan with service version detection
54	3. Banner grabbing on open ports
55	4. WAF/CDN detection (Cloudflare, Akamai, AWS CloudFront)
56
57	### Step 5: Technology Fingerprinting
58
59	```bash
60	python scripts/tech_fingerprint.py --input {live_hosts_file}
61	```
62
63	Detect:
64	- Web server (Apache, Nginx, IIS, etc.)
65	- Programming language/framework (PHP, Django, Rails, Spring, etc.)
66	- CMS (WordPress, Drupal, Joomla)
67	- JavaScript frameworks (React, Angular, Vue)
68	- Third-party services and integrations
69	- HTTP security headers (or lack thereof)
70
71	### Step 6: OSINT Correlation
72
73	```bash
74	python scripts/osint_correlator.py --domain {target_domain}
75	```
76
77	Gather:
78	- WHOIS history and registrant patterns
79	- ASN mapping and IP range ownership
80	- Reverse IP lookups (shared hosting)
81	- Email addresses associated with the domain
82	- Social media and GitHub references
83	- Leaked credentials databases (public sources only)
84
85	### Step 7: Google Dorking
86
87	```bash
88	python scripts/google_dorker.py --domain {target_domain} --dork-file references/dorks-database.txt
89	```
90
91	Automated searches for:
92	- Exposed files: `site:{domain} filetype:pdf\|doc\|xls\|sql\|bak\|log\|env`
93	- Login panels: `site:{domain} inurl:admin\|login\|dashboard`
94	- Directory listings: `site:{domain} intitle:"index of"`
95	- Error messages: `site:{domain} "sql syntax" \| "warning" \| "error"`
96	- Sensitive endpoints: `site:{domain} inurl:api\|graphql\|swagger\|config`
97
98	### Step 8: Wayback Machine Analysis
99
100	```bash
101	python scripts/wayback_analyzer.py --domain {target_domain}
102	```
103
104	Extract:
105	- Historical endpoints no longer linked but still active
106	- Removed pages with sensitive information
107	- Old API versions still responding
108	- Parameter names from archived URLs
109	- JavaScript files with hardcoded secrets
110
111	### Step 9: Output Generation
112	Compile all findings into a structured report:
113
114	```bash
115	python scripts/generate_report.py --project {project_name}
116	```
117
118	Output format:
119	1. Executive Summary: domain count, subdomain count, live hosts, open ports, technologies
120	2. Asset Inventory: full list with metadata per asset
121	3. Technology Matrix: tech stack per subdomain
122	4. Potential Entry Points: ranked by interest level
123	5. Relationship Graph: JSON graph of domain relationships
124	6. Raw Data: all collected data in JSON for pipeline consumption
125
126	## Output Files Structure
127	```
128	output/{project_name}/
129	summary.md # Human-readable report
130	assets.json # Full asset inventory
131	subdomains.json # All discovered subdomains
132	ports.json # Port scan results
133	technologies.json # Tech fingerprinting
134	osint.json # OSINT findings
135	wayback.json # Historical data
136	graph.json # Relationship graph
137	dorking_results.json # Google dork findings
138	```
139
140	## Error Handling
141
142	### Common Issues
143
144	#### Rate Limiting on External APIs
145	If you see "429 Too Many Requests":
146	1. The scripts have built-in rate l

People who liked this also viewed

6 picks

Type