reconnaissance
starsforks
How to install reconnaissance?
transilienceai/communitytools/reconnaissance
$npx -y skills add transilienceai/communitytools --skill reconnaissanceDomain assessment and web application mapping - subdomain discovery, port scanning, endpoint enumeration, API discovery, and attack surface analysis.
SKILL.md
| 1 | # Reconnaissance |
| 2 | |
| 3 | Domain and web application reconnaissance. Discovers subdomains, open ports, endpoints, APIs, and JavaScript routes to build attack surface inventory. |
| 4 | |
| 5 | ## Phases |
| 6 | |
| 7 | ### Domain Assessment |
| 8 | 1. **Subdomain Discovery** - Passive DNS, certificate transparency, DNS brute-forcing, zone transfers |
| 9 | 2. **Port Scanning** - nmap/masscan (top 1000/10000/all), service detection, OS fingerprinting |
| 10 | 3. **Service Enumeration** - Version detection, banner grabbing, protocol-specific enumeration |
| 11 | |
| 12 | ### Web Application Mapping |
| 13 | 0. **Software Inventory** - Dependencies, frameworks, SBOM generation |
| 14 | 1. **Active Scanning** - ffuf, gobuster, nikto, ZAP spider for directories/files |
| 15 | 2. **API Discovery** - REST, GraphQL, SOAP, WebSocket, Swagger/OpenAPI docs |
| 16 | 3. **JavaScript & SPA** - Client-side routes, dynamic scripts, browser storage |
| 17 | 4. **Surface Analysis** - Categorize attack surfaces, prioritize by risk |
| 18 | |
| 19 | ## Output |
| 20 | |
| 21 | ``` |
| 22 | inventory/ - JSON: subdomains, ports, endpoints, APIs, SBOM |
| 23 | analysis/ - MD: attack-surface, testing-checklist |
| 24 | raw/ - Tool outputs (nmap, ffuf, ZAP, subfinder) |
| 25 | ``` |
| 26 | |
| 27 | ## Tools |
| 28 | |
| 29 | subfinder, amass, certspotter, crt.sh, nmap, masscan, nuclei, sslscan, ffuf, gobuster, nikto, ZAP, Playwright MCP |
| 30 | |
| 31 | ## Related Skills |
| 32 | |
| 33 | - `/osint` - Run alongside reconnaissance for repository enumeration, secret scanning, and git history analysis |
| 34 | |
| 35 | ## Rules |
| 36 | |
| 37 | 1. Passive discovery before active scanning |
| 38 | 2. Always run `/osint` in parallel during Phase 2 |
| 39 | 3. Respect rate limits |
| 40 | 4. Verify subdomains are live before port scanning |
| 41 | 5. Save all raw tool outputs |
| 42 | 6. **HTTP response header vhost leaks**: Always check response headers on the raw IP (`curl -sI http://IP/`). Headers like `X-Backend-Server`, `X-Forwarded-Host`, `X-Served-By`, `X-Upstream` often leak internal hostnames/vhosts not discoverable via DNS or brute-force. Add discovered hostnames to `/etc/hosts` immediately. |
| 43 | 7. **Wildcard SSL certs** (`*.domain.tld` in SAN) = strong indicator of hidden vhosts. Always run vhost brute-force with `ffuf -u https://IP -k -H "Host: FUZZ.domain.tld" -w subdomains.txt -mc all -fs <default_size>` when wildcard SAN detected. Compare response size/status vs default vhost to identify valid subdomains. |
| 44 | 8. **VHost enumeration without ffuf**: When ffuf/gobuster unavailable, use shell loop: `for sub in admin dev api portal dashboard staging git; do code=$(curl -s -o /dev/null -w "%{http_code}:%{size_download}" -H "Host: ${sub}.DOMAIN" http://IP); echo "$sub: $code"; done` — filter by response size difference from default page. |
| 45 | 9. **Web management panels**: When discovering admin vhosts (admin.*, panel.*, manage.*), check for known management UIs: Nginx UI (`manifest.json` → "Nginx UI"), Cockpit, Webmin, phpMyAdmin. These often have unauthenticated API endpoints or known CVEs. Check `/api/backup`, `/api/settings`, `/api/install` for Nginx UI specifically. |
| 46 | 10. **Mobile / native client downloads on the marketing tier**: when the public web tier has a download link to an `.apk` / `.dmg` / `.exe` / `.ipa`, the "real" API endpoint and its required headers are usually **only reachable from that client**. The web HTML shows nothing useful; the API is gated behind a static User-Agent / Host that's hard-coded in the binary. Always pull the client and decompile/extract before assuming the box is a static-page only. For Android React Native: `unzip <app>.apk -d ext/ && file ext/assets/index.android.bundle`. The bundle is typically obfuscator.io-style (`function _0xNNNN(idx)` decoder + `array.shift()` IIFE that loops until a parseInt-equation == target). Don't reverse it by hand — extract decoder + array literal + IIFE into a standalone Node.js file and dump every index in seconds: `for(let i=baseHex; i<baseHex+arr.length; i++) console.log(i.toString(16), _0xDecode(i));`. Then reconstruct the obfuscated object literal of the API call (URL = concatenation of 4–7 short fragments, headers likewise) and replay with the recovered values verbatim. |
| 47 | 11. **Focused AD port scan for Windows targets**: when initial fingerprinting shows a Windows DC archetype (any of 53/135/139/445/389 open), skip `-p-` and run a focused scan over the 13 AD-relevant ports first — it finishes in seconds and covers everything that matters. |
| 48 | ```bash |
| 49 | nmap -Pn -sC -sV -p 53,88,135,139,389,445,464,593,636,3268,3269,5985,5986,9389 -oA recon/ad-focused TARGET |
| 50 | ``` |
| 51 | Ports rationale: 53 DNS, 88 Kerberos, 135 RPC, 139/445 SMB, 389/636 LDAP/LDAPS, 464 kpasswd, 593 RPC-over-HTTPS, 3268/3269 GC/GC-LDAPS, 5985 WinRM (HTTP), 5986 WinRM (HTTPS — cert auth), 9389 AD Web Services. Always probe BOTH 5985 and 5986 — when 5985 is filtered, 5986 with client-cert auth is a common foothold path (see `skills/system/reference/foothold-patterns.md` WinRM cert-auth foothold). Only fall back to `-p-` if (a) no flag-yiel |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
