skills.rest
Steffen025
Steffen025COMMUNITY
Explore all skills by this author →
WebsiteGitHub

Recon

Automate passive and authorized active infrastructure reconnaissance across domains, IPs, netblocks, and ASNs.

186|24|Updated Jan 1, 2026
Search Tags:#security#DNS#OSINT#netblock#recon#ASN#WHOIS
One-click install
npx skills add https://github.com/Steffen025/pai-opencode --skill recon
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Recon
Source: https://github.com/Steffen025/pai-opencode/tree/main/.opencode/skills/Recon
Command: npx skills add https://github.com/Steffen025/pai-opencode --skill recon

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill provides structured infrastructure and network reconnaissance to help security teams quickly map an organization’s attack surface—domains, IPs, netblocks, and ASNs—using both passive sources and authorized active methods.

Core Features & Use Cases

  • Passive Domain & IP Recon: WHOIS, DNS enumeration, certificate transparency, and OSINT aggregation to identify assets.
  • Active Recon (Authorized): Port scanning, service detection, and vulnerability probing only when proper authorization exists.
  • Attack Surface Mapping: Builds a structured map of domains, subdomains, IP mappings, and ASN ownership to guide pentest planning and risk assessment.
  • Use Case: Before a security assessment, you run Recon on a target to discover all assets and endpoints, producing a centralized inventory for further testing.

Quick Start

  • Activate passive recon on example.com: Do passive recon on example.com.
  • Map infrastructure for a domain: Recon domain example.com to enumerate domains, IPs, and ASNs.
  • Report location: Output is stored under ~/.opencode/MEMORY/WORK/{current_work}/scratch/recon-example-com/

Frequently Asked Questions about Recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I map an organization's attack surface using DNS and WHOIS data?▼

Attack surface mapping uses passive OSINT discovery like DNS enumeration, WHOIS lookups, and certificate transparency to identify domains, subdomains, and IP blocks. This structured inventory guides targeted security assessments and pentest planning.

What is passive OSINT discovery and when do I need it for network reconnaissance?▼

Passive OSINT discovery gathers infrastructure data without directly querying target systems. You need it before authorized active scanning to safely identify domains, IPs, and ASN ownership using certificate transparency and public records.

Do I need an IPInfo API key to perform ASN and netblock reconnaissance?▼

Yes, ASN and organization data reconnaissance requires an IPInfo API key. This key enables the Skill to map netblocks and autonomous system numbers, while standard tools like dig and whois handle basic DNS lookups.

How do I enumerate subdomains and IPs for a specific domain?▼

Subdomain and IP enumeration starts by running passive recon on the target domain. The process aggregates DNS records, certificate transparency logs, and WHOIS data, storing the resulting asset inventory under a dedicated scratch directory.

Can I run authorized active scanning for port detection alongside passive recon?▼

Yes, authorized active scanning supports port scanning and service detection using optional MCP tools like httpx and naabu. This requires an explicit authorization framework before probing identified domains and IP blocks.

What are the limitations of using standard tools like whois and dig for infrastructure mapping?▼

Standard tools like whois and dig provide basic DNS and registration data but lack automated OSINT aggregation and ASN mapping. For comprehensive attack surface analysis, they require supplementation with API-driven data and optional MCP scanning tools.

Related Skills

Explore More Education & Research Skills→
GratefulJinx77GratefulJinx77

Recon

Perform passive and active network reconnaissance using WHOIS, DNS, and OSINT.

Community
Advanced
xijunwwxijunww
1

recon

Automate penetration testing reconnaissance to discover assets and attack surfaces.

Community
Advanced
BishopCodesBishopCodes
1

Recon

Enumerate subdomains, DNS records, mail servers, and open ports.

Community
Advanced
GarrettRoiGarrettRoi

domain-intel

Perform passive domain reconnaissance via Certificate Transparency, SSL, WHOIS, and DNS checks.

Community
Intermediate