skills.rest
DorianGallo
DorianGalloCOMMUNITY
Explore all skills by this author →
GitHub

recon-and-methodology

Guide systematic reconnaissance and bug bounty methodology for attack surface mapping.

5|2|Updated May 16, 2026
Search Tags:#reconnaissance#endpoint discovery#nuclei#bug bounty#technology fingerprinting#attack surface mapping#pentesting workflow
One-click install
npx skills add https://github.com/DorianGallo/hack-skills-local --skill recon-and-methodology-doriangallo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: recon-and-methodology
Source: https://github.com/DorianGallo/hack-skills-local/tree/main/skills/recon-and-methodology
Command: npx skills add https://github.com/DorianGallo/hack-skills-local --skill recon-and-methodology-doriangallo

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Reconnaissance and testing planning often waste time with ad-hoc enumeration and inconsistent coverage, causing teams to miss high-impact bugs on new targets.

Core Features & Use Cases

  • Structured recon workflow: builds a repeatable hierarchy from scope definition through asset discovery, tech fingerprinting, and endpoint mapping.
  • Target discovery and validation: supports passive/active subdomain enumeration, port/service discovery, and HTTP probing to identify what is actually reachable.
  • Methodical bug hunting mindset: emphasizes systematic coverage (what to test, in what order, and why), plus program triage to focus on features most likely to yield findings.
  • Quick testing accelerators: guides use of common tooling for directory/parameter discovery and nuclei-based triage for misconfigurations and exposures.

Quick Start

Use recon-and-methodology to systematically enumerate subdomains, fingerprint technologies, discover endpoints and parameters, then prioritize testing based on likely bug paths for your chosen bug bounty program.

Frequently Asked Questions about recon-and-methodology

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is the best way to map an attack surface for bug bounty hunting?▼

Mapping an attack surface systematically requires a structured recon hierarchy, starting from scope definition and moving through asset discovery, tech fingerprinting, and endpoint mapping to prioritize high-probability bug classes.

How do I systematically enumerate subdomains and discover endpoints for a new target?▼

To systematically enumerate subdomains and discover endpoints, follow a structured workflow of passive and active subdomain enumeration, HTTP probing, technology fingerprinting, and directory/parameter discovery to identify reachable assets.

Can I use nuclei for initial vulnerability triage during attack surface mapping?▼

Yes, nuclei-based triage is used during attack surface mapping to quickly identify misconfigurations and exposures, helping you prioritize testing on features most likely to yield findings for your bug bounty program.

Why does ad-hoc reconnaissance waste time and cause missed bugs on new targets?▼

Ad-hoc reconnaissance causes inconsistent coverage and wasted time because it lacks a structured testing hierarchy, leading teams to miss high-impact bugs that systematic asset discovery and endpoint mapping would uncover.

Does this structured reconnaissance workflow cover both web and API testing surfaces?▼

Yes, the structured reconnaissance workflow covers both web and API surfaces, guiding subdomain and service enumeration, technology fingerprinting, and endpoint or parameter discovery to drive next-step vulnerability testing.

Related Skills

Explore More Education & Research Skills→
dreadnodedreadnode
11

reconnaissance-planning

Plan phased low-to-high noise reconnaissance workflows for external attack surface management.

Official
Intermediate
EntroVyxEntroVyx
3

hunt-sharepoint

Fingerprint Microsoft SharePoint Server versions and detect authentication bypass vulnerabilities.

Community
Advanced
transilienceaitransilienceai
462

domain-assessment

Coordinate subdomain discovery and port scanning to build a domain attack surface inventory.

Official
Basic
MADEVALMADEVAL
9

atomic-framework-app-auth

Map Atomic Framework app and authentication knowledge to controllers, models, session flows, and auth facades.

Community
Advanced