What problem does it solve?
Security testers often jump into exploitation without a complete picture of the target's attack surface, missing subdomains, hidden endpoints, CDN-protected origins, and fingerprintable components. This Skill provides a structured reconnaissance workflow that runs passive intelligence gathering first, then an active enumeration pipeline, and records all findings to a shared project blackboard.
Core Features & Use Cases
- Passive Reconnaissance: Collects intelligence without touching the target using whois, amass, crt.sh certificate transparency, FOFA, Shodan, and web archive lookups.
- Active Enumeration Pipeline: Chains subfinder, dnsx, httpx, naabu, nmap, katana, ffuf, and nuclei to enumerate subdomains, ports, URLs, and vulnerabilities.
- Evasion & Fingerprinting Playbooks: Documents techniques for DNS region-based CDN bypass, CDN 502/404 differential analysis, Nginx catch-all detection, BT Panel identification, and UniApp/DCloud APK reversing.
- Use Case: Starting an authorized penetration test against example.com, you run the passive phase to enumerate subdomains via crt.sh and FOFA, then pipe live hosts through httpx and nuclei to identify a vulnerable framework version, which triggers follow-up vulnerability intelligence gathering.
Quick Start
Start reconnaissance on the authorized target example.com by running the passive enumeration phase first and recording all discovered assets to the project blackboard.
