skills.rest
mlvpatel
mlvpatelCOMMUNITY
Explore all skills by this author →
GitHub

ghost-recon

Automate web2 reconnaissance with subdomain enumeration, host discovery, URL crawling, directory fuzzing, and JavaScript analysis.

1|Updated Apr 3, 2026
Search Tags:#subdomain-enumeration#asset-discovery#continuous-monitoring#url-crawling#js-analysis#web2-recon
One-click install
npx skills add https://github.com/mlvpatel/sentinel-ai-offensive --skill ghost-recon
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ghost-recon
Source: https://github.com/mlvpatel/sentinel-ai-offensive/tree/main/skills/ghost-recon
Command: npx skills add https://github.com/mlvpatel/sentinel-ai-offensive --skill ghost-recon

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Web2 reconnaissance can be laborious and error-prone. ghost-recon automates subdomain enumeration, host discovery, URL crawling, directory fuzzing, and JS analysis to quickly map an attack surface and prioritize targets.

Core Features & Use Cases

  • Subdomain enumeration using subfinder, Chaos API, and assetfinder to build a comprehensive domain list.
  • Live host discovery with dnsx and httpx to identify reachable targets and endpoints.
  • URL crawling with katana, waybackurls, and gau to collect historical and current paths.
  • Directory fuzzing with ffuf to uncover hidden resources and endpoints.
  • JavaScript analysis with LinkFinder and SecretFinder to reveal exposed APIs and secrets.
  • Continuous monitoring for new subdomains, JS changes, and GitHub commits to track surface evolution. Use Case: When starting a web2 target, ghost-recon quickly generates an asset map and keeps it updated as the surface changes.

Quick Start

Start the ghost-recon pipeline on a web2 target to automatically enumerate subdomains, identify live hosts, crawl URLs, fuzz directories, analyze JavaScript, and set up continuous monitoring for surface changes.

Frequently Asked Questions about ghost-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate web2 reconnaissance and map my attack surface?▼

Automate web2 reconnaissance by orchestrating subdomain enumeration, live-host discovery, URL crawling, directory fuzzing, and JavaScript analysis to quickly map an attack surface and prioritize targets.

What is the best way to enumerate subdomains and find live hosts for a target?▼

The best way to enumerate subdomains and find live hosts is by chaining tools like subfinder, Chaos API, and assetfinder for discovery, followed by dnsx and httpx to identify reachable targets and endpoints.

Can I use waybackurls and katana together for URL crawling?▼

Yes, you can use katana, waybackurls, and gau together for URL crawling to collect historical and current paths, ensuring comprehensive coverage when mapping target endpoints.

How do I find exposed APIs and secrets in JavaScript files during recon?▼

Find exposed APIs and secrets during recon by running JavaScript analysis using LinkFinder and SecretFinder, which automatically parse JS files to reveal hidden resources and sensitive data.

How do you detect new subdomains and track attack surface changes over time?▼

Detect new subdomains and track attack surface changes by setting up continuous monitoring that alerts on JS changes, new subdomains, and GitHub commits to maintain an up-to-date surface map.

What tools do I need for directory fuzzing to uncover hidden endpoints?▼

For directory fuzzing to uncover hidden resources and endpoints, you need ffuf, which is integrated to automatically discover paths not found during standard URL crawling.

Related Skills

Explore More Software Engineering Skills→
Mikacr1138Mikacr1138
2

web2-recon

Automate web2 reconnaissance from subdomain enumeration to JS analysis.

Community
Intermediate
matteocervellimatteocervelli
25

security-scanner

Scan codebases for secrets, vulnerable dependencies, and insecure patterns.

Community
Advanced
transilienceaitransilienceai
462

domain-assessment

Coordinate subdomain discovery and port scanning to build a domain attack surface inventory.

Official
Basic
pdparchitectpdparchitect
13

bug-bounty

Execute reconnaissance, vulnerability analysis, and reporting for web applications and APIs.

Community
Advanced