skills.rest
jayjpatel9717
jayjpatel9717COMMUNITY
Explore all skills by this author →
GitHub

Recon & Attack Surface Mapping

Map attack surfaces via DNS enumeration, port scanning, and vulnerability assessment.

Updated Jun 3, 2026
Search Tags:#vulnerability assessment#reconnaissance#cybersecurity#attack surface#subdomain discovery
One-click install
npx skills add https://github.com/jayjpatel9717/kurukshetra_updated --skill recon-attack-surface-mapping
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Recon & Attack Surface Mapping
Source: https://github.com/jayjpatel9717/kurukshetra_updated/tree/main/squads/pentest/agents/arjun/skills/recon
Command: npx skills add https://github.com/jayjpatel9717/kurukshetra_updated --skill recon-attack-surface-mapping

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires subfinder, dnsx, httpx, katana, waybackurls, gau, gf, nuclei, linkfinder.py, SecretFinder.py, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

Identifies and maps all potential attack surfaces for a target, facilitating thorough vulnerability assessment.

Core Features & Use Cases

  • Comprehensive Reconnaissance: Enumerates subdomains, resolves live hosts, discovers open ports, and performs HTTP probing.
  • Passive Reconnaissance: Utilizes crt.sh, WHOIS, DNS records, and passive tools.
  • Active Reconnaissance: Employing subdomain enumeration tools, port scanning, and tech fingerprinting.
  • Deep Crawl and Content Discovery: Scans live hosts for endpoints and sensitive files, utilizing web crawling tools and JavaScript analysis.
  • Vulnerability Discovery: Employing Nuclei templates and pattern recognition for identifying CVEs and misconfigurations.

Quick Start

To begin the recon process for a target, execute the following command:

./scripts/recon_probe.sh <TARGET_DOMAIN>

Frequently Asked Questions about Recon & Attack Surface Mapping

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I map the attack surface for a target domain before a vulnerability assessment?▼

To map an attack surface, you enumerate subdomains, verify live hosts, scan ports, and fingerprint tech stacks. This Skill automates that reconnaissance workflow using tools like subfinder, httpx, and katana to identify potential attack vectors.

What is the best way to discover subdomains and live hosts for bug bounty reconnaissance?▼

Subdomain discovery and live host verification are handled passively via DNS records and actively via tools like subfinder and dnsx. It then probes discovered hosts with httpx to confirm live targets suitable for vulnerability scanning.

Can I use Nuclei templates for vulnerability discovery during attack surface mapping?▼

Yes, Nuclei templates are employed during the vulnerability discovery phase. After crawling live hosts and analyzing JavaScript for sensitive files, Nuclei is used to identify CVEs and misconfigurations across the mapped attack surface.

Does this reconnaissance process include deep web crawling and content discovery?▼

Yes, the process performs deep crawling and content discovery using katana, waybackurls, and gau. It scans live hosts for endpoints and analyzes JavaScript files with linkfinder and SecretFinder to extract hidden parameters and secrets.

Do I need to install dependencies like subfinder and httpx to run the recon probe?▼

Yes, executing the recon probe requires dependencies like subfinder, dnsx, httpx, katana, waybackurls, gau, gf, nuclei, and Python scripts for JavaScript analysis to be installed in your environment to perform the automated reconnaissance steps.

What is passive reconnaissance versus active reconnaissance for cybersecurity assessment?▼

Passive reconnaissance utilizes crt.sh, WHOIS, and DNS records without direct target interaction, while active reconnaissance employs subdomain enumeration, port scanning, and tech fingerprinting to directly probe the target network.

Related Skills

sseshachalasseshachala

web2-recon

Automate web2 asset discovery and attack-surface mapping with integrated recon tools.

Community
Advanced
xijunwwxijunww
1

known-product-exploit

Automate identification, exploitation, and post-exploitation of known product vulnerabilities with Nuclei.

Community
Advanced
DaddyElonMusk69DaddyElonMusk69

domain-intel

Enumerate subdomains and inspect SSL certificates, WHOIS, and DNS records.

Community
Advanced
transilienceaitransilienceai
462

domain-assessment

Coordinate subdomain discovery and port scanning to build a domain attack surface inventory.

Official
Basic