recon

Enumerate target subdomains, DNS resolutions, live hosts, and open ports.

18|3|Updated Apr 16, 2026

Search Tags:#automation #nmap #pentest #recon #subdomains #live-hosts

Ready to run

npx skills add https://github.com/kalpmodi/akira --skill recon-kalpmodi

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: recon
Source: https://github.com/kalpmodi/akira/tree/main/skills/recon
Command: npx skills add https://github.com/kalpmodi/akira --skill recon-kalpmodi

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Recon reduces manual overhead in the initial pentest phase by running a reconnaissance toolkit against a target and summarizing findings for downstream phases.

Core Features & Use Cases

Enumerates subdomains, DNS resolutions, live hosts, and open ports to build a clear target profile.
Generates a concise summary file (interesting_recon.md) for downstream engagement steps and decision making.
Updates session state with discovered intel to enable follow-on phases like secrets and exploits.
Triggered by user prompts such as "run recon" or "phase 1" for consistent onboarding.

Quick Start

Ask the AI to run recon on a target, e.g., '/recon example.com', to produce a summarized intel report for downstream phases.

Frequently Asked Questions about recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate subdomain enumeration and live host discovery for a pentest target?▼

Automating recon enumerates target subdomains, DNS resolutions, live hosts, and open ports, then summarizes the findings. This builds a clear target profile and generates a concise report for downstream engagement steps and decision making.

What is the best way to run phase 1 reconnaissance and save the intel for later use?▼

Running phase 1 reconnaissance executes a toolkit against a target and writes a summarized report to interesting_recon.md. It also updates session state with discovered intel to enable follow-on phases like secrets and exploits.

Can I use automated recon to identify open ports and DNS resolutions without manual Nmap commands?▼

Yes, automated recon identifies and enumerates target subdomains, DNS resolutions, live hosts, and open ports during reconnaissance. This reduces manual overhead in the initial pentest phase by running a reconnaissance toolkit against the target.

Does this reconnaissance automation integrate discovered intel with downstream exploitation phases?▼

Yes, reconnaissance automation updates session state with discovered intel to support downstream phases. This enables follow-on phases like secrets and exploits to use the summarized target profile for further engagement steps.

What limitations are there when running automated recon against a target?▼

Automated recon is designed for phase 1 engagements and scenarios where the user requests reconnaissance. It focuses on enumerating subdomains, DNS resolutions, live hosts, and open ports, reducing manual overhead but limited to initial target profiling.

How do I start a reconnaissance task to surface key intel for my target?▼

You can start a reconnaissance task by asking the AI to run recon on a target, such as '/recon example.com'. This produces a summarized intel report for downstream phases and updates the session state with discovered target information.