Verified:GitHub

Recon

Automate network reconnaissance for domains, IPs, and netblocks.

1|1|Updated Mar 1, 2026

Search Tags:#vulnerability assessment #penetration testing #subdomain enumeration #network scanning #attack surface #recon

Ready to run

npx skills add https://github.com/RooseveltAdvisors/claude-agent-stack --skill recon-rooseveltadvisors

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: Recon
Source: https://github.com/RooseveltAdvisors/claude-agent-stack/tree/main/skills/Security/Recon
Command: npx skills add https://github.com/RooseveltAdvisors/claude-agent-stack --skill recon-rooseveltadvisors

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires subfinder, chaos-client, dnsx, httpx, naabu, whois-parser, cidr-utils, ipinfo-client, crt.sh, ffuf, katana, masscan, and includes scripts (resource) and references (resource) and data (resource) components.

What problem does it solve?

This Skill automates the process of discovering and mapping an organization's internet-facing infrastructure, identifying potential attack vectors and security weaknesses.

Core Features & Use Cases

Comprehensive Reconnaissance: Perform passive and active scans on domains, IPs, and netblocks.
Attack Surface Mapping: Identify subdomains, open ports, services, and technologies.
Use Case: Before a penetration test, use this Skill to get a complete picture of the target's digital footprint, including all discovered subdomains, their associated IPs, and open ports, providing a crucial starting point for the assessment.

Quick Start

Run passive reconnaissance on example.com to map its infrastructure.

Frequently Asked Questions about Recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate subdomain enumeration and attack surface mapping for a target domain?▼

Automate attack surface mapping by running passive and active reconnaissance on domains, IPs, and netblocks. This process discovers subdomains, open ports, services, and technologies to identify potential security weaknesses and vulnerabilities.

What is the best way to map an organization's internet-facing infrastructure before a penetration test?▼

Map internet-facing infrastructure by performing comprehensive network reconnaissance. This identifies subdomains, associated IPs, and open ports, providing a complete picture of the target's digital footprint as a starting point for vulnerability assessment.

Can I scan netblocks and IP addresses to identify open ports and running services?▼

Scanning netblocks and IP addresses identifies open ports and running services using active and passive techniques. Integrating tools like naabu and httpx gathers intelligence on discovered hosts, revealing active technologies and potential attack vectors.

Does network reconnaissance require passive data sources or can it actively scan infrastructure?▼

Network reconnaissance utilizes both passive and active scanning techniques. Passive data sources like crt.sh and WHOIS gather intelligence without direct interaction, while active tools like naabu probe infrastructure directly to identify open ports and services.

How do I find network vulnerabilities and security weaknesses using automated reconnaissance?▼

Find network vulnerabilities by automating reconnaissance to map the entire attack surface. Identifying subdomains, active services, and technologies reveals security weaknesses and potential attack vectors across the target's internet-facing infrastructure.

What tools do I need to perform comprehensive network scanning and subdomain discovery?▼

Comprehensive network scanning and subdomain discovery require integrations with WHOIS, dig, crt.sh, IPInfo, naabu, and httpx. These dependencies gather intelligence on domains, IPs, and netblocks to map infrastructure and identify services.