Perform passive and active network reconnaissance using WHOIS, DNS, and OSINT.
npx skills add https://github.com/GratefulJinx77/tai --skill recon-gratefuljinx77
Please help me install this Agent Skill. Skill: Recon Source: https://github.com/GratefulJinx77/tai/tree/main/.tai/skills/security/Recon Command: npx skills add https://github.com/GratefulJinx77/tai --skill recon-gratefuljinx77
This Skill provides comprehensive network reconnaissance and analysis capabilities, enabling users to identify and assess potential security vulnerabilities in their infrastructure.
Use the recon skill to perform a passive domain reconnaissance on example.com.
High-intent search queries and answers about installing and using this skill.
Network reconnaissance maps an attack surface by combining WHOIS lookups, DNS enumeration, certificate transparency, and IPInfo API queries. This process identifies domains, IP addresses, netblocks, and ASNs to expose potential infrastructure vulnerabilities and entry points.
Passive reconnaissance gathers OSINT and historical DNS data without directly touching the target, while active reconnaissance uses tools like naabu and httpx for direct scanning. Both methods identify vulnerabilities but require appropriate permissions for active scanning.
Yes, you can use Shodan and Censys for OSINT infrastructure analysis. These platforms integrate with WHOIS, reverse DNS, and BGP/ASN information gathering to provide deeper intelligence insights during network reconnaissance and vulnerability assessment.
Gathering BGP and ASN information for network security relies on public database searches and tools like IPInfo API, SecurityTrails, and VirusTotal. You need appropriate API keys and configured dependencies to execute comprehensive reconnaissance and analysis.
The best way to enumerate DNS records and historical DNS data is using dig and nslookup for active queries, combined with certificate transparency logs and public database searches. This DNS enumeration reveals subdomains and infrastructure changes over time.
Active reconnaissance limitations include potential service disruption and strict permission requirements. Avoid active scanning with tools like naabu and httpx unless you have explicit authorization, relying instead on passive OSINT methods for safe vulnerability assessment.
RooseveltAdvisorsAutomate network reconnaissance for domains, IPs, and netblocks.
JingyueCongDiscovers and analyzes internet-exposed assets using the Shodan API.
macaughDetect network services and versions on discovered hosts via active probing.
jaskaranhundalDiscover, inventory, and risk-score internet-facing assets continuously.
