skills.rest
lNwNl
lNwNlCOMMUNITY
Explore all skills by this author →
GitHub

recon-and-methodology

Build a systematic reconnaissance workflow mapping target assets into an actionable attack surface.

2|Updated May 15, 2026
Search Tags:#reconnaissance#subdomain enumeration#endpoint discovery#bug bounty#api discovery#testing methodology#web tech fingerprinting
One-click install
npx skills add https://github.com/lNwNl/Methodos --skill recon-and-methodology-lnwnl
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: recon-and-methodology
Source: https://github.com/lNwNl/Methodos/tree/main/docker/opencode/skills/recon-and-methodology
Command: npx skills add https://github.com/lNwNl/Methodos --skill recon-and-methodology-lnwnl

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It helps you turn an unknown target into a structured recon plan by guiding disciplined asset discovery, technology fingerprinting, and endpoint enumeration so you can find vulnerabilities methodically instead of relying on random guessing.

Core Features & Use Cases

  • Recon hierarchy and coverage model: Organizes work from scope selection to asset discovery, tech fingerprinting, endpoint discovery, and vulnerability testing so every run produces actionable findings.
  • Subdomain, service, and HTTP surface discovery: Uses passive and active enumeration approaches plus port and live-host probing to identify what exists before you test it.
  • Endpoint and parameter discovery for web and APIs: Applies directory brute force, virtual-host discovery, JS mining, and API/GraphQL/OpenAPI path checks to uncover attackable entry points and hidden functionality.
  • Bug bounty triage guidance: Prioritizes where time yields the highest bug probability (auth flows, file upload, admin panels, business logic) to improve outcomes and reduce wasted effort.
  • Operational mindset and validation: Incorporates a hunter’s mental model (go deep on one program, look for where others don’t, follow the filter) to reduce false leads and improve test precision.

Quick Start

Use the recon-and-methodology skill to generate a step-by-step recon plan for a new target domain by enumerating subdomains, fingerprinting web technologies, and listing candidate endpoints for structured testing.

Frequently Asked Questions about recon-and-methodology

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is subdomain enumeration and how does it fit into web reconnaissance?▼

Subdomain enumeration is the process of discovering hidden subdomains to map a target's attack surface. This skill structures web reconnaissance by organizing work from scope selection into passive and active enumeration, live-host probing, and subsequent vulnerability testing.

How do I discover hidden API endpoints and parameters during security testing?▼

You discover hidden API endpoints by applying directory brute force, JS mining, and GraphQL or OpenAPI path checks. This skill guides endpoint and parameter discovery to uncover attackable entry points and hidden functionality across web and API targets.

What is the best way to structure a bug bounty reconnaissance workflow?▼

The best way to structure bug bounty recon is following a stepwise exploration hierarchy from asset discovery to vulnerability testing. This skill builds a systematic workflow that prioritizes high-probability targets like auth flows and admin panels to reduce wasted effort.

How does web technology fingerprinting improve testing methodology?▼

Web technology fingerprinting identifies the frameworks and platforms running on a target to improve testing methodology. This skill incorporates fingerprinting after asset discovery, allowing you to validate live hosts and select appropriate tools for subsequent vulnerability testing.

Can I use this reconnaissance methodology for API discovery and GraphQL testing?▼

Yes, this reconnaissance methodology supports API discovery by applying specific checks for GraphQL and OpenAPI paths. It systematically uncovers attackable entry points and hidden functionality across both web and API targets during security testing.

When should I use passive enumeration versus active probing in target reconnaissance?▼

Use passive enumeration first to identify existing assets safely, then apply active probing for port and live-host discovery. This skill incorporates a hunter's mental model to validate findings, reduce false leads, and improve test precision before vulnerability testing.

Related Skills

Explore More Education & Research Skills→
balic-AI-ML-R-D-Resourcesbalic-AI-ML-R-D-Resources

security-audit-context-building

Map architecture, trust boundaries, and data flows for security audit scoping.

Official
Advanced
jinyimeng01jinyimeng01
54

exploit-agent

Validate suspected web vulnerabilities and generate structured exploit reports.

Community
Advanced
Kalp1774Kalp1774
18

recon

Run subdomain enumeration, DNS resolution, live-host probing, and nmap scanning on a target.

Community
Intermediate
ricardoo022ricardoo022

scan-fase-1

Identify configurations, secrets, and attack-surface exposure from JS-bundled web applications.

Community
Advanced