reconnaissance

Identify subdomains, ports, endpoints, APIs, and attack surfaces.

7|1|Updated Apr 14, 2026

Search Tags:#vulnerability assessment #reconnaissance #port scanning #domain assessment #web application mapping

Ready to run

npx skills add https://github.com/ArianHobson333/claude-bug-bounty-stack --skill reconnaissance-arianhobson333

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: reconnaissance
Source: https://github.com/ArianHobson333/claude-bug-bounty-stack/tree/main/vendor/communitytools/projects/pentest/.claude/skills/reconnaissance
Command: npx skills add https://github.com/ArianHobson333/claude-bug-bounty-stack --skill reconnaissance-arianhobson333

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill simplifies the process of domain and web application reconnaissance, offering an efficient way to identify subdomains, open ports, endpoints, APIs, and attack surfaces.

Core Features & Use Cases

Domain Assessment: Subdomain discovery, certificate transparency, DNS brute-forcing, and zone transfers.
Port Scanning: Automated port scanning with options for top 1000, 10000, or all ports, with service detection and OS fingerprinting.
Service Enumeration: Version detection, banner grabbing, and protocol-specific enumeration.
Web Application Mapping: Software inventory, active scanning, API discovery, JavaScript & SPA analysis, and surface analysis.

Quick Start

Run the recon skill with the target domain 'example.com' to initiate domain assessment and web application mapping.

Frequently Asked Questions about reconnaissance

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform web application mapping and identify APIs for a target domain?▼

Web application mapping identifies software inventory, endpoints, and APIs through active scanning and JavaScript analysis. This Skill conducts comprehensive domain reconnaissance to discover subdomains, open ports, and exposed attack surfaces automatically.

What is the best way to automate subdomain discovery and port scanning for vulnerability assessment?▼

Automated subdomain discovery and port scanning accelerate vulnerability assessment by detecting exposed services. This Skill combines passive DNS, certificate transparency, and active port scanning with service detection to map large-scale web properties.

Can I use active scanning and service enumeration to find open ports on large-scale web properties?▼

Yes, active scanning and service enumeration detect open ports across large-scale web properties. You can scan the top 1000, 10000, or all ports while performing version detection, banner grabbing, and OS fingerprinting to identify exposed services.

Does domain reconnaissance require passive DNS and certificate transparency checks before brute-forcing?▼

Domain reconnaissance utilizes passive DNS and certificate transparency checks alongside DNS brute-forcing and zone transfers. This combination ensures comprehensive subdomain discovery without relying solely on active techniques that may trigger alerts.

What limitations should I expect when running active port scanning and API discovery?▼

Active port scanning and API discovery may trigger network alerts or rate limits on target systems. Because this Skill requires active scanning tools, operations should be authorized and configured carefully to avoid disruption during surface analysis.

Why does service enumeration matter for identifying an attack surface during reconnaissance?▼

Service enumeration identifies protocol-specific details and software versions that define the attack surface. By grabbing banners and detecting versions, this Skill exposes potential vulnerabilities before deeper vulnerability assessment begins.