skills.rest
phatblat
phatblatCOMMUNITY
Explore all skills by this author →
Website𝕏@phatblatGitHub

Recon

Automate infrastructure and network reconnaissance for domains, IPs, and netblocks.

12|Updated Aug 16, 2019
Search Tags:#security#reconnaissance#network#attack surface#domain#ip#recon
One-click install
npx skills add https://github.com/phatblat/dotfiles --skill recon-phatblat
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Recon
Source: https://github.com/phatblat/dotfiles/tree/main/.claude/skills/Recon
Command: npx skills add https://github.com/phatblat/dotfiles --skill recon-phatblat

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires ipinfo-client.ts, cidr-utils.ts, dns-utils.ts, whois-parser.ts, massscan.ts, endpointdiscovery.ts, pathdiscovery.ts, bountyprograms.ts, corporatestructure.ts, portscan.ts, analyzescanresultsgemini3.md, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill automates the process of gathering intelligence on network infrastructure, including domains, IP addresses, and netblocks, to understand an organization's attack surface.

Core Features & Use Cases

  • Passive Reconnaissance: Gather information using WHOIS, DNS, and certificate transparency without touching targets.
  • Active Reconnaissance: Perform authorized port scanning, service detection, and technology fingerprinting.
  • Use Case: When starting a penetration test for a new client, use this Skill to map out all their internet-facing assets, identify live hosts, and understand their technology stack before launching any active attacks.

Quick Start

Use the recon skill to perform passive reconnaissance on example.com.

Frequently Asked Questions about Recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate network reconnaissance to map an organization's attack surface?▼

Network reconnaissance is automated by integrating WHOIS, DNS, and certificate transparency for passive intelligence, alongside authorized port scanning and service detection for active mapping. This builds a comprehensive view of internet-facing infrastructure.

What is the difference between passive and active reconnaissance techniques?▼

Passive reconnaissance gathers target intelligence using OSINT sources like WHOIS and certificate transparency without touching the target. Active reconnaissance performs authorized port scanning and technology fingerprinting to identify live hosts.

How do I map domains and netblocks to find live internet-facing assets?▼

Mapping domains and netblocks involves querying DNS records and utilizing IP information clients to identify active subnets. This process discovers live hosts and exposes the technology stack before deeper investigation.

Can I perform ASN research and IP-specific investigation for a new penetration test?▼

Yes, ASN research and IP-specific investigation are supported. The skill queries WHOIS data and CIDR utilities to map allocated netblocks, identifying all internet-facing assets assigned to an organization.

Does this reconnaissance workflow integrate OSINT for target intelligence gathering?▼

Yes, the workflow integrates OSINT for comprehensive target intelligence gathering. It combines passive certificate transparency, DNS queries, and WHOIS parsing to map infrastructure without active scanning.

When should I avoid active port scanning during infrastructure mapping?▼

Active port scanning should be avoided when unauthorized or when targeting networks with strict intrusion detection. Rely on passive reconnaissance techniques like DNS queries and certificate transparency instead.

Related Skills

Explore More Software Engineering Skills→
jwm-axonijwm-axoni
3

recon

Map network infrastructure via passive and authorized active reconnaissance.

Community
Advanced
Chid0kChid0k

gen-report

Generate vulnerability reports from security scan results aligned with OWASP Top 10.

Community
Advanced
Quill-AgentQuill-Agent
3

domain-intel

Perform passive domain reconnaissance including subdomain discovery, SSL inspection, WHOIS, DNS records, and availability checks.

Community
Advanced
Steffen025Steffen025
186

Recon

Automate passive and authorized active infrastructure reconnaissance across domains, IPs, netblocks, and ASNs.

Community
Advanced