skills.rest
salmanabdurrahman
salmanabdurrahmanCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

recon-web-surface

Maps web-accessible surfaces by fingerprinting technologies, analyzing HTTP responses, and detecting virtual hosts.

Updated Jul 30, 2026
Search Tags:#reconnaissance#web-security#pentesting#fingerprinting#asset-inventory#vulnerability-assessment
One-click install
npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill recon-web-surface
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: recon-web-surface
Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/recon-web-surface
Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill recon-web-surface

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill solves the challenge of manually mapping large, complex web surfaces by automating technology fingerprinting, HTTP response analysis, and virtual-host detection while strictly enforcing security and scope policies.

Core Features & Use Cases

  • Automated Fingerprinting: Identifies web servers, frameworks, CMS, and CDN/WAF presence using advanced signature matching.
  • Security Posture Analysis: Evaluates security headers and TLS configurations to identify potential vulnerabilities.
  • Use Case: During a security assessment, use this skill to ingest a list of subdomains and generate a categorized inventory of technologies and potential attack surfaces, ensuring all probes remain within defined scope boundaries.

Quick Start

Use the recon-web-surface skill to map the web surface of the target domain provided in the current scope file.

Frequently Asked Questions about recon-web-surface

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate web asset fingerprinting for a large list of subdomains?▼

Web asset fingerprinting for multiple subdomains can be automated by ingesting the list and processing HTTP responses to identify web servers, frameworks, CMS, and CDN/WAF presence using signature matching.

What is the best way to map web-accessible surfaces during a penetration test?▼

Mapping web-accessible surfaces involves analyzing HTTP responses, fingerprinting technologies, and detecting virtual hosts to generate a categorized inventory of the target's attack surface for authorized assessments.

How does virtual host detection work for security reconnaissance?▼

Virtual host detection works by analyzing web server responses to mapped assets, identifying distinct hosted applications or sites on the same IP, which broadens the technology and vulnerability scope inventory.

Can I perform security posture analysis on HTTP responses and TLS configurations?▼

Security posture analysis evaluates HTTP responses by checking security headers and TLS configurations, identifying potential vulnerabilities and routing technologies to known security weaknesses.

Does web reconnaissance enforce scope validation and rate-limiting?▼

Yes, automated web reconnaissance enforces strict operational requirements including scope validation and rate-limiting to ensure all probes remain within authorized boundaries during asset inventory mapping.

When should I not use automated technology fingerprinting?▼

Automated technology fingerprinting should not be used without a defined scope file, as strict operational requirements mandate scope validation and rate-limiting to prevent unauthorized probing during security assessments.

Related Skills

Explore More Software Engineering Skills→
salmanabdurrahmansalmanabdurrahman

enum-web-content

Automate web content enumeration and directory discovery across authorized in-scope targets.

Community
Advanced
clawpod-appclawpod-app
46

vulnerability-assessment

Analyze a given CVE's impact on your asset inventory and prioritize remediation with a timeline.

Community
Intermediate
narlyseorgnarlyseorg
6

recon-and-enumeration

Automate reconnaissance and enumeration of endpoints, services, and technologies.

Community
Advanced
transilienceaitransilienceai
462

domain-assessment

Coordinate subdomain discovery and port scanning to build a domain attack surface inventory.

Official
Basic