skills.rest
Ap6pack
Ap6packCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

recon-asset-discovery

Map authorized external attack surfaces by discovering domains, subdomains, IPs, and DNS signals.

4|Updated Apr 29, 2026
Search Tags:#subdomain enumeration#asset discovery#whois#rdap#certificate transparency#passive recon#dns reconnaissance
One-click install
npx skills add https://github.com/Ap6pack/outrider-recon --skill recon-asset-discovery
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: recon-asset-discovery
Source: https://github.com/Ap6pack/outrider-recon/tree/main/skills/recon-asset-discovery
Command: npx skills add https://github.com/Ap6pack/outrider-recon --skill recon-asset-discovery

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill reduces the uncertainty and manual effort involved in mapping an organization's authorized external attack surface by consolidating passive discovery, DNS intelligence, and domain registration data.

Core Features & Use Cases

  • Passive Asset Discovery: Enumerate subdomains through certificate transparency, passive DNS, threat intelligence, and reconnaissance sources.
  • Domain and DNS Intelligence: Perform WHOIS/RDAP lookups, catalog DNS records, identify SaaS tenancy signals, and confirm Microsoft 365 infrastructure.
  • Evidence-Based Recon Handoffs: Deduplicate typed assets, assign confidence, preserve scope boundaries, and route domains, emails, and IPs to downstream analysis workflows.
  • Use Case: For an authorized engagement, discover related subdomains, identify exposed services and SaaS providers from DNS records, and produce a prioritized asset inventory for web and infrastructure review.

Quick Start

Ask the recon asset discovery skill to passively enumerate the authorized root domain, perform WHOIS/RDAP and DNS cataloging, and return a deduplicated asset list with confidence labels.

Frequently Asked Questions about recon-asset-discovery

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I passively enumerate subdomains for an authorized external attack surface?▼

Subdomain enumeration for an authorized external attack surface is performed passively by querying certificate transparency logs, passive DNS, and threat intelligence sources. The skill deduplicates discovered assets and assigns confidence labels for downstream analysis.

What is the best way to discover SaaS tenancy signals from DNS records?▼

Discovering SaaS tenancy signals from DNS records involves cataloging DNS entries and identifying specific provider infrastructure, such as confirming Microsoft 365. The skill parses DNS records to infer SaaS tenancy and classifies the assets accordingly.

How does certificate transparency analysis help with domain reconnaissance?▼

Certificate transparency analysis aids domain reconnaissance by exposing historically issued SSL/TLS certificates, which reveal hidden subdomains and related infrastructure. The skill uses this data to map authorized external assets without active scanning.

Can I use WHOIS and RDAP lookups to classify domains and IPs for penetration testing?▼

WHOIS and RDAP lookups retrieve domain registration data to classify domains and IPs during penetration testing. The skill performs these lookups, preserves scope boundaries, and produces typed asset taxonomies with evidence-linked outputs.

Does passive reconnaissance require active DNS scanning to map external assets?▼

Passive reconnaissance does not require active DNS scanning; it relies on certificate transparency, passive DNS, and WHOIS/RDAP data. The skill maps external assets and identifies exposed services while maintaining strict scope and approval controls.

What limitations exist when inferring SaaS tenancy from DNS signals?▼

Inferring SaaS tenancy from DNS signals is limited to publicly visible DNS records and may not capture unconfigured or shadow SaaS services. The skill mitigates this by using fallback discovery sources and deduplicating typed assets to improve accuracy.

Related Skills

Explore More Software Engineering Skills→
jassicsjassics
6

recon

Coordinates passive and active enumeration of authorized attack surfaces for penetration testing.

Community
Intermediate
rajyeole6rajyeole6

agency-penetration-tester

Conduct authorized penetration testing across network, web, and cloud infrastructure.

Community
Advanced
zerwizzerwiz

domain-intel

Your AI-powered command and data center for domain intelligence, delivering instant situational awareness and automated reporting to accelerate your next move.

Community
Intermediate
macaughmacaugh
5

Service Fingerprinting

Detect network services and versions on discovered hosts via active probing.

Community
Advanced