Recon & Attack Surface Mapping

Map attack surfaces via DNS enumeration, port scanning, and vulnerability assessment.

Updated Jun 3, 2026

Search Tags:#vulnerability assessment #reconnaissance #cybersecurity #attack surface #subdomain discovery

Ready to run

npx skills add https://github.com/jayjpatel9717/kurukshetra_updated --skill recon-attack-surface-mapping

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: Recon & Attack Surface Mapping
Source: https://github.com/jayjpatel9717/kurukshetra_updated/tree/main/squads/pentest/agents/arjun/skills/recon
Command: npx skills add https://github.com/jayjpatel9717/kurukshetra_updated --skill recon-attack-surface-mapping

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires subfinder, dnsx, httpx, katana, waybackurls, gau, gf, nuclei, linkfinder.py, SecretFinder.py, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

Identifies and maps all potential attack surfaces for a target, facilitating thorough vulnerability assessment.

Core Features & Use Cases

Comprehensive Reconnaissance: Enumerates subdomains, resolves live hosts, discovers open ports, and performs HTTP probing.
Passive Reconnaissance: Utilizes crt.sh, WHOIS, DNS records, and passive tools.
Active Reconnaissance: Employing subdomain enumeration tools, port scanning, and tech fingerprinting.
Deep Crawl and Content Discovery: Scans live hosts for endpoints and sensitive files, utilizing web crawling tools and JavaScript analysis.
Vulnerability Discovery: Employing Nuclei templates and pattern recognition for identifying CVEs and misconfigurations.

Quick Start

To begin the recon process for a target, execute the following command:

./scripts/recon_probe.sh <TARGET_DOMAIN>

Frequently Asked Questions about Recon & Attack Surface Mapping

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I map the attack surface for a target domain before a vulnerability assessment?▼

To map an attack surface, you enumerate subdomains, verify live hosts, scan ports, and fingerprint tech stacks. This Skill automates that reconnaissance workflow using tools like subfinder, httpx, and katana to identify potential attack vectors.

What is the best way to discover subdomains and live hosts for bug bounty reconnaissance?▼

Subdomain discovery and live host verification are handled passively via DNS records and actively via tools like subfinder and dnsx. It then probes discovered hosts with httpx to confirm live targets suitable for vulnerability scanning.

Can I use Nuclei templates for vulnerability discovery during attack surface mapping?▼

Yes, Nuclei templates are employed during the vulnerability discovery phase. After crawling live hosts and analyzing JavaScript for sensitive files, Nuclei is used to identify CVEs and misconfigurations across the mapped attack surface.

Does this reconnaissance process include deep web crawling and content discovery?▼

Yes, the process performs deep crawling and content discovery using katana, waybackurls, and gau. It scans live hosts for endpoints and analyzes JavaScript files with linkfinder and SecretFinder to extract hidden parameters and secrets.

Do I need to install dependencies like subfinder and httpx to run the recon probe?▼

Yes, executing the recon probe requires dependencies like subfinder, dnsx, httpx, katana, waybackurls, gau, gf, nuclei, and Python scripts for JavaScript analysis to be installed in your environment to perform the automated reconnaissance steps.

What is passive reconnaissance versus active reconnaissance for cybersecurity assessment?▼

Passive reconnaissance utilizes crt.sh, WHOIS, and DNS records without direct target interaction, while active reconnaissance employs subdomain enumeration, port scanning, and tech fingerprinting to directly probe the target network.