recon-and-methodology

Attack surface mapping starts with broad subdomain enumeration, technology fingerprinting, and endpoint discovery to identify exposed hosts, services, and web paths. This Skill transforms a single authorized domain into a structured, prioritized testing plan that highlights high-value entry points for systematic vulnerability triage.

Organizing web reconnaissance requires a repeatable sequence moving from broad asset discovery to focused vulnerability checks. This Skill structures authorized security testing into a step-by-step plan that systematically covers hosts, ports, technologies, and likely API or admin paths before active testing begins.

Technology fingerprinting infers software frameworks and services running on a target, while endpoint discovery surfaces hidden routes and API entry points. This Skill guides tool-driven reconnaissance to expose these web paths and technologies, building a structured checklist for authorized penetration testing workflows.

Yes, this Skill is designed for authorized security testing, supporting subdomain enumeration, technology fingerprinting, and automated scanning guidance. It maps exposed assets and services into a structured web reconnaissance plan, ensuring systematic coverage of authorized targets during bug bounty workflows.

No prior reconnaissance results are required. This Skill takes a new authorized target and removes the guesswork by generating a complete recon checklist covering hosts, ports, technologies, and high-value attack paths, turning a blank starting point into a prioritized testing plan.

A structured recon and testing plan is necessary when you need systematic coverage of assets, services, and web paths rather than random checks. Use this Skill to move from broad enumeration to focused vulnerability triage, ensuring repeatable sequences for authorized bug bounty and penetration testing.