skills.rest
cuongnguyen-git
cuongnguyen-gitCOMMUNITY
Explore all skills by this author →
GitHub

new-target

Run scope-restricted bug bounty recon for subdomains, live hosts, endpoints, JS assets, and CVEs.

Updated May 14, 2026
Search Tags:#subdomain discovery#bug bounty#technology fingerprinting#cve lookup#js analysis#endpoint mapping#recon enumeration
One-click install
npx skills add https://github.com/cuongnguyen-git/bug-bounty --skill new-target
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: new-target
Source: https://github.com/cuongnguyen-git/bug-bounty/tree/main/.claude/skills/new-target
Command: npx skills add https://github.com/cuongnguyen-git/bug-bounty --skill new-target

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you quickly and safely understand a brand-new bug bounty target by building an initial map of scope-aligned domains, live hosts, endpoints, JS assets, and relevant CVEs without jumping into exploitation.

Core Features & Use Cases

  • Scope-driven recon: Parses scope.md, generates a deduplicated root domain list (handling wildcards), and runs every phase only within scope-aligned roots.
  • End-to-end recon workflow: Enumerates subdomains, identifies live hosts, fingerprints tech stack, maps endpoints and historical URLs, and extracts JS-heavy surfaces.
  • Target triage outputs: Produces recon artifacts plus a summary file with counts, discovered technologies, suggested manual starting points, and CVE hits for identified tech.
  • Guardrails for safety: Explicitly avoids exploitation, avoids brute force, avoids writing to /mnt/c/, and only runs targeted nuclei CVE templates (critical/high).

Quick Start

Run the skill with the program identifier as the argument so it reads ~/bugbounty/[target]/scope.md and writes all recon outputs into ~/bugbounty/[target]/recon/ in Kali WSL.

Frequently Asked Questions about new-target

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run safe initial bug bounty recon on a new target?▼

Bug bounty subdomain discovery works by enumerating scope-aligned root domains to find live hosts, then mapping endpoints and extracting JS assets. This structured mapping workflow avoids exploitation and brute force, focusing on safe, initial surface mapping.

How do I map endpoints and extract JS assets during recon enumeration?▼

Initial recon requires a Kali WSL environment with Bash execution capabilities and specific tools installed under `~/go/bin/`. You must also have a `~/bugbounty/[target]/scope.md` file available to define the program boundaries before running the enumeration workflow.

Can I use this recon workflow to find critical CVEs in the technology stack?▼

Recon outputs are written under `~/bugbounty/[target]/recon/` and include recon artifacts plus a summary file. This summary contains counts of discovered assets, identified technologies, suggested manual starting points, and CVE hits for the detected tech stack.

What limitations apply when running first-time bug bounty program onboarding?▼

Scope-driven recon parses the `scope.md` file, generates a deduplicated root domain list, and handles wildcards to ensure every phase operates only within scope-aligned roots. This prevents testing out-of-scope assets during subdomain discovery and endpoint mapping.

Related Skills

Explore More Software Engineering Skills→
BradliebsBradliebs

unfreeze

Remove the edit freeze boundary to allow edits across all directories.

Community
Basic
sayseven7sayseven7
11

recon-and-methodology

Map attack surfaces and build structured web recon plans for authorized targets.

Community
Advanced
zebbernzebbern
4.5k

Red Team Tools and Methodology

Automate red-team reconnaissance and vulnerability discovery workflows.

Community
Advanced
Kalp1774Kalp1774
18

recon

Run subdomain enumeration, DNS resolution, live-host probing, and nmap scanning on a target.

Community
Intermediate