recon

Map network infrastructure via passive and authorized active reconnaissance.

3|Updated Mar 4, 2026
One-click install
npx skills add https://github.com/jwm-axoni/auggie-pai --skill recon-jwm-axoni
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: recon
Source: https://github.com/jwm-axoni/auggie-pai/tree/main/skills/recon
Command: npx skills add https://github.com/jwm-axoni/auggie-pai --skill recon-jwm-axoni

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Technical reconnaissance of network infrastructure, including domains, IPs, netblocks, and ASNs, is essential for understanding exposure and planning secure operations. This Skill orchestrates passive data gathering with authorized active techniques to provide a structured view of assets and risks.

Core Features & Use Cases

  • Passive reconnaissance to collect public data about targets (domains, IPs, ASN mappings, and netblocks)
  • Authorized active recon workflows with strict confirmation and scope validation
  • Consolidated reporting of discovered assets and risk indicators for security assessments

Quick Start

Perform a quick passive recon on a target domain by running WHOIS and DNS enumeration to generate a reporting slate.

Frequently Asked Questions about recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I map network infrastructure using passive reconnaissance?

Map network infrastructure using passive reconnaissance by collecting public data about domains, IPs, ASN mappings, and netblocks without direct interaction. This approach relies on WHOIS, DNS enumeration, and IP lookup to generate a consolidated reporting slate for security assessments.

Can I perform active recon on domains and netblocks safely?

Yes, you can perform active recon on domains and netblocks safely through authorized active workflows. The process applies strict confirmation, scope validation, defined authorization rules, and logging to ensure non-destructive testing during your investigation.

What is an ASN investigation and when do I need it for attack surface mapping?

ASN investigation identifies the Autonomous System Number associated with target IP addresses and netblocks. You need it for attack surface mapping to consolidate discovered assets and risk indicators across passive and active workflows for security assessments.

Does this approach require authorization rules before running DNS recon and WHOIS lookups?

Yes, authorized active recon requires defined authorization rules and scope validation before running DNS recon and WHOIS lookups. Non-destructive testing and logging ensure all active investigations remain strictly in-scope.

What's the best way to enumerate assets across domains and IP addresses?

The best way to enumerate assets across domains and IP addresses is to orchestrate passive data gathering with authorized active techniques. Applying DNS, WHOIS, IP lookup, and ASN investigation provides a structured view of assets and risks.

When should I not use active techniques for network reconnaissance?

You should not use active techniques for network reconnaissance when strict scope validation and defined authorization rules are absent. Non-destructive testing requirements mean active workflows must be limited to confirmed, in-scope investigations.