skills.rest
mahmutka
mahmutkaCOMMUNITY
Explore all skills by this author →
GitHub

Pentest Recon Expert

Run PTES-aligned reconnaissance workflows for authorized penetration testing engagements.

13|3|Updated Feb 25, 2026
Search Tags:#penetration testing#reconnaissance#OSINT#security assessment#attack surface mapping#network enumeration#CVE prioritization
One-click install
npx skills add https://github.com/mahmutka/cybersecurity-claude-skills --skill pentest-recon-expert
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Pentest Recon Expert
Source: https://github.com/mahmutka/cybersecurity-claude-skills/tree/main/pentest-recon
Command: npx skills add https://github.com/mahmutka/cybersecurity-claude-skills --skill pentest-recon-expert

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Unstructured or incomplete reconnaissance for authorized penetration tests leads to missed attack vectors, wasted effort, and incomplete security assessments. This Skill provides a standardized, PTES-aligned workflow to conduct thorough, scoped information gathering for authorized security testing engagements.

Core Features & Use Cases

  • PTES-Aligned Recon Workflow: Covers passive OSINT (DNS, WHOIS, Shodan, GitHub secret scanning) and active enumeration (port scanning, service fingerprinting, SMB/LDAP/SNMP enumeration) in a structured four-phase approach.
  • CVE Prioritization & Attack Surface Reporting: Maps discovered services and versions to relevant CVEs, prioritizes findings by exploitability, and generates a standardized attack surface summary template for client reporting.
  • Use Case: For an authorized penetration test of example.com, use this Skill to gather all subdomains, identify open ports and running services, find associated high-risk CVEs, and compile a prioritized list of attack paths to guide subsequent testing.

Quick Start

Use the pentest-recon skill to perform full reconnaissance and generate a prioritized attack surface summary for the authorized target example.com.

Frequently Asked Questions about Pentest Recon Expert

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I structure reconnaissance for an authorized penetration test?▼

A PTES-aligned reconnaissance workflow structures your authorized penetration test by guiding passive OSINT collection and active service enumeration across a standardized four-phase approach to eliminate unstructured information gathering.

What is the best way to map an external attack surface for web assets?▼

Mapping an external attack surface for web assets requires combining passive OSINT collection, like DNS and Shodan queries, with active service enumeration to identify open ports and prioritize relevant CVEs.

Can I use this PTES workflow for SMB and LDAP network enumeration?▼

Yes, this PTES workflow supports SMB and LDAP network enumeration by including active service fingerprinting capabilities for SMB, LDAP, and SNMP protocols alongside standard port scanning operations.

How do I prioritize CVEs after network enumeration?▼

You can prioritize CVEs after network enumeration by mapping discovered services and their specific versions to relevant vulnerabilities, then ranking the findings by exploitability to guide subsequent testing.

Does passive OSINT collection include GitHub secret scanning?▼

Passive OSINT collection includes GitHub secret scanning alongside DNS, WHOIS, and Shodan queries to identify exposed credentials and infrastructure details without actively engaging the target.

When do I need a standardized attack surface report for a security assessment?▼

A standardized attack surface report is needed for a security assessment when delivering client reporting, requiring a compiled summary of prioritized findings and potential attack paths to guide red team operations.

Related Skills

Explore More Software Engineering Skills→
salmanabdurrahmansalmanabdurrahman

recon-dns

Enumerate DNS records and assess email security for authorized domains.

Community
Advanced
wuyoscarwuyoscar
934

cyber-scapy-recon

Generate PTES-compliant penetration test reports from Scapy engagement data.

Community
Intermediate
macaughmacaugh
5

Service Fingerprinting

Detect network services and versions on discovered hosts via active probing.

Community
Advanced
Magnatrix-LabMagnatrix-Lab
1

osint-methodology

Structure OSINT operations from asset discovery to reporting.

Community
Advanced