skills.rest
trilwu
trilwuCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-reconnaissance

Map external attack surface via OSINT, subdomain enumeration, and port scanning.

109|11|Updated Nov 13, 2025
Search Tags:#reconnaissance#pentesting#osint#port-scanning#attack-surface#subdomain#cloud-discovery
One-click install
npx skills add https://github.com/trilwu/secskills --skill performing-reconnaissance
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-reconnaissance
Source: https://github.com/trilwu/secskills/tree/main/secskills/skills/initial-access-recon
Command: npx skills add https://github.com/trilwu/secskills --skill performing-reconnaissance

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Gather intelligence and map attack surface by performing OSINT, subdomain enumeration, port scanning, web reconnaissance, email harvesting, and cloud asset discovery to support initial access planning.

Core Features & Use Cases

  • OSINT collection and passive reconnaissance to identify potential exposure
  • Subdomain enumeration and domain mapping to outline attack surface
  • Port and service discovery to assess network exposure
  • Web application reconnaissance to detect technologies and entry points
  • Cloud asset discovery to locate public assets and misconfigurations
  • Use Case: Prepare an initial access assessment for a target with limited access to internal networks

Quick Start

Ask me to perform reconnaissance on a target to automatically gather OSINT, enumerate subdomains, scan ports, and identify exposed cloud assets.

Frequently Asked Questions about performing-reconnaissance

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is attack surface mapping and how does OSINT reconnaissance work?▼

Attack surface mapping identifies and catalogs a target's external exposure through OSINT reconnaissance, gathering passive intelligence to enumerate subdomains, scan ports, and locate public cloud assets.

How do I perform subdomain enumeration and port scanning for initial access planning?▼

Perform subdomain enumeration and port scanning by applying OSINT collection and network discovery techniques to map external exposure, providing repeatable steps to assess web entry points and service vulnerabilities.

Can I use this reconnaissance approach for cloud asset discovery and identifying misconfigurations?▼

Yes, cloud asset discovery is a core reconnaissance function used to locate public cloud assets and detect misconfigurations, mapping external exposure to support initial access planning.

What is the best way to map a target's external exposure with limited internal network access?▼

The best way to map external exposure with limited internal access is combining passive OSINT collection with active subdomain enumeration, web reconnaissance, and email harvesting.

Does web reconnaissance detect technologies and entry points for target domains?▼

Yes, web application reconnaissance detects underlying technologies and identifies potential entry points by mapping the target domain's external attack surface.

When should I not use active port scanning during attack surface reconnaissance?▼

Active port scanning should be avoided when authorization is unclear or safety requirements demand passive-only intelligence gathering, as active reconnaissance directly interacts with target systems.

Related Skills

Explore More Data & Analytics Skills→
brucesongsbrucesongs
60

recon-osint

Perform OSINT reconnaissance to build target profiles from public sources.

Community
Advanced
cmndcntrlcybercmndcntrlcyber
3

hunt-rce

Detect and exploit remote code execution vulnerabilities in applications.

Community
Advanced
transilienceaitransilienceai
462

cve-testing

Coordinate CVE vulnerability testing across identified technology stacks and APIs.

Official
Basic
Muath2000Muath2000

attack-surface-analyst

Discover and monitor internet-facing assets for external attack surface management.

Community
Advanced