Recon

Perform passive and active infrastructure reconnaissance using DNS, WHOIS, and IPInfo.

Updated Feb 27, 2026

Search Tags:#reconnaissance #network security #OSINT #security assessment #infrastructure mapping

Ready to run

npx skills add https://github.com/luisgustavooliveira/skills --skill recon-luisgustavooliveira

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: Recon
Source: https://github.com/luisgustavooliveira/skills/tree/main/Recon
Command: npx skills add https://github.com/luisgustavooliveira/skills --skill recon-luisgustavooliveira

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires ipinfo-api, whois, dig, nslookup, curl, httpx, naabu, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill provides comprehensive reconnaissance capabilities for infrastructure and networks, enabling in-depth analysis and mapping of technical assets.

Core Features & Use Cases

Passive Reconnaissance: Gathers passive intelligence using public sources such as WHOIS, DNS, and certificate transparency.
Active Reconnaissance: Performs authorized active scanning including port scanning, service detection, and technology fingerprinting.
Integration with OSINT: Integrates with OSINT data to map infrastructure and identify attack surfaces.
Use Case: After OSINT identifies a target company, use this Skill to map their technical infrastructure, including domains, IPs, and ASNs.

Quick Start

Use the recon skill to perform a passive domain reconnaissance on example.com.

Frequently Asked Questions about Recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform passive and active network reconnaissance on a target domain?▼

Network reconnaissance combines passive intelligence gathering from public sources like WHOIS and DNS with authorized active scanning for port detection and service fingerprinting. This Skill executes both phases to map technical assets and identify attack surfaces for infrastructure domains.

What techniques are used for OSINT infrastructure mapping and attack surface identification?▼

OSINT infrastructure mapping utilizes WHOIS lookups, DNS queries, certificate transparency logs, and IPInfo API geolocation. These passive reconnaissance techniques identify domains, IP addresses, and ASN associations to map a target company's technical infrastructure footprint.

Do I need an IPInfo API key to gather geolocation and AS information during security assessments?▼

Yes, an IPInfo API key is required to retrieve geolocation and Autonomous System number details during security assessments. The Skill depends on this external service alongside system tools like dig, nslookup, and httpx for comprehensive infrastructure analysis.

Can I use naabu and httpx for authorized port scanning and technology fingerprinting?▼

Yes, naabu and httpx are integrated dependencies for authorized active reconnaissance. Naabu executes port scanning while httpx performs technology fingerprinting and service detection to map exposed infrastructure components.

What are the limitations of using active scanning versus passive intelligence gathering for threat intelligence?▼

Active scanning limitations include requiring explicit authorization to avoid legal issues and potential service disruption. Passive intelligence gathering relies on public sources like DNS and WHOIS, offering threat intelligence without directly interacting with the target infrastructure.

How does DNS reconnaissance with dig and nslookup map network infrastructure?▼

DNS reconnaissance with dig and nslookup queries domain name servers to extract records mapping network infrastructure. This passive technique identifies subdomains, IP addresses, and mail servers, providing foundational data for security assessments and threat intelligence.