recon

Perform passive reconnaissance, OSINT gathering, and DNS analysis for penetration testing.

Updated Aug 27, 2026

Search Tags:#reconnaissance #subdomain enumeration #dns #osint #whois #shodan

Ready to run

npx skills add https://github.com/duriandurino/openclawrino --skill recon-duriandurino

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: recon
Source: https://github.com/duriandurino/openclawrino/tree/main/recon
Command: npx skills add https://github.com/duriandurino/openclawrino --skill recon-duriandurino

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires dig, whois, curl, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill gathers crucial intelligence about a target system or domain through passive reconnaissance, providing a foundational understanding without direct interaction.

Core Features & Use Cases

Passive Reconnaissance: Collects information like DNS records, WHOIS data, and Shodan search results.
Subdomain Enumeration: Identifies subdomains associated with a target domain.
OSINT Gathering: Aggregates open-source intelligence for a comprehensive view.
Use Case: Before initiating any active testing, use this Skill to understand the target's digital footprint, identify potential attack vectors, and gather context.

Quick Start

Run a full passive reconnaissance workflow on the domain example.com.

Frequently Asked Questions about recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform passive reconnaissance and OSINT gathering for a target domain?▼

Subdomain enumeration identifies associated subdomains for a target domain. This Skill uses DNS queries and OSINT gathering to map the target's digital footprint and identify potential attack vectors passively.

Can I query Shodan and WHOIS data to fingerprint services passively?▼

Yes, querying Shodan and WHOIS data allows you to fingerprint services and check domain ownership passively. This Skill leverages curl and whois commands to gather this open-source intelligence for penetration testing.

What's the best way to gather DNS records and check WHOIS ownership before active testing?▼

The best way to gather DNS records and check WHOIS ownership is using passive reconnaissance. This Skill queries DNS configurations and domain registration data to provide a foundational understanding of the target without direct interaction.

Why use passive reconnaissance instead of active scanning for target intelligence?▼

Passive reconnaissance is used instead of active scanning to gather target intelligence without alerting the target. It collects DNS records, Shodan results, and OSINT to understand the digital footprint and identify attack vectors safely.