skills.rest
BishopCodes
BishopCodesCOMMUNITY
Explore all skills by this author →
GitHub

Recon

Enumerate subdomains, DNS records, mail servers, and open ports.

1|Updated Mar 11, 2026
Search Tags:#reconnaissance#subdomain enumeration#network mapping#port scanning#attack surface#ip lookup
One-click install
npx skills add https://github.com/BishopCodes/OpenPAI --skill recon-bishopcodes
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Recon
Source: https://github.com/BishopCodes/OpenPAI/tree/main/skills/Security/Recon
Command: npx skills add https://github.com/BishopCodes/OpenPAI --skill recon-bishopcodes

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires subfinder, chaos-client, dnsx, httpx, naabu, whois-parser, ipinfo-client, cidr-utils, endpoint-discovery, masscan, path-discovery, port-scan, corporate-structure, bounty-programs, and includes scripts (resource) and references (resource) and data (resource) components.

What problem does it solve?

This Skill automates the process of gathering intelligence on domains, IP addresses, and network infrastructure, providing a comprehensive view of an organization's attack surface.

Core Features & Use Cases

  • Domain Reconnaissance: Enumerate subdomains, DNS records, mail servers, and associated IPs.
  • IP Address Investigation: Gather geolocation, ASN, WHOIS, and service information for specific IPs.
  • Netblock Scanning: Map live hosts and open ports within CIDR ranges (requires authorization).
  • Use Case: When starting a penetration test for a new client, use this Skill to discover all their internet-facing assets, identify potential vulnerabilities, and understand their network architecture before launching active scans.

Quick Start

Use the recon skill to perform passive reconnaissance on example.com.

Frequently Asked Questions about Recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enumerate subdomains and map the attack surface for a target domain?▼

Subdomain enumeration and attack surface mapping are performed by integrating OSINT tools like subfinder and crt.sh to discover associated domains, DNS records, and mail servers. This passive reconnaissance identifies all internet-facing assets before launching active scans.

What is the best way to gather IP geolocation and ASN details for network infrastructure?▼

Gathering IP geolocation and ASN details is achieved by querying WHOIS data and IPInfo. This investigation provides service information, netblock ownership, and broader intelligence for specific IP addresses within the target's network infrastructure.

Can I scan for open ports within CIDR netblocks using this reconnaissance approach?▼

Scanning for open ports within CIDR netblocks is supported using naabu and masscan integrations. This active reconnaissance maps live hosts and identifies exposed services across network ranges, requiring proper authorization before execution.

Does this method work with passive OSINT tools or does it require active network scanning?▼

Passive OSINT gathering works alongside active network scanning techniques. The approach utilizes WHOIS, dig, and crt.sh for passive intelligence, while naabu and httpx perform active probing to identify detailed vulnerabilities and live hosts.

How do I discover live web servers and identify vulnerabilities after finding subdomains?▼

Discovering live web servers after subdomain enumeration is done using httpx to probe for live HTTP services. This identifies responsive web applications, extracts service banners, and highlights potential vulnerabilities across the discovered attack surface.

Related Skills

Explore More Software Engineering Skills→
phatblatphatblat
12

Recon

Automate infrastructure and network reconnaissance for domains, IPs, and netblocks.

Community
Advanced
RooseveltAdvisorsRooseveltAdvisors
1

Recon

Automate network reconnaissance for domains, IPs, and netblocks.

Community
Advanced
matthew-johnsonmatthew-johnson

domain-intel

Identify passive domain intelligence data using Python standard library without external APIs.

Community
Intermediate
uphiagouphiago
1.1k

web2-recon

Automate web2 attack surface mapping with subdomain enumeration, URL crawling, and JavaScript analysis.

Community
Advanced