skills.rest
ArianHobson333
ArianHobson333COMMUNITY
Explore all skills by this author →
GitHub

reconnaissance

Identify subdomains, ports, endpoints, APIs, and attack surfaces.

7|1|Updated Apr 14, 2026
Search Tags:#vulnerability assessment#reconnaissance#port scanning#domain assessment#web application mapping
One-click install
npx skills add https://github.com/ArianHobson333/claude-bug-bounty-stack --skill reconnaissance-arianhobson333
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: reconnaissance
Source: https://github.com/ArianHobson333/claude-bug-bounty-stack/tree/main/vendor/communitytools/projects/pentest/.claude/skills/reconnaissance
Command: npx skills add https://github.com/ArianHobson333/claude-bug-bounty-stack --skill reconnaissance-arianhobson333

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill simplifies the process of domain and web application reconnaissance, offering an efficient way to identify subdomains, open ports, endpoints, APIs, and attack surfaces.

Core Features & Use Cases

  • Domain Assessment: Subdomain discovery, certificate transparency, DNS brute-forcing, and zone transfers.
  • Port Scanning: Automated port scanning with options for top 1000, 10000, or all ports, with service detection and OS fingerprinting.
  • Service Enumeration: Version detection, banner grabbing, and protocol-specific enumeration.
  • Web Application Mapping: Software inventory, active scanning, API discovery, JavaScript & SPA analysis, and surface analysis.

Quick Start

Run the recon skill with the target domain 'example.com' to initiate domain assessment and web application mapping.

Frequently Asked Questions about reconnaissance

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform web application mapping and identify APIs for a target domain?▼

Web application mapping identifies software inventory, endpoints, and APIs through active scanning and JavaScript analysis. This Skill conducts comprehensive domain reconnaissance to discover subdomains, open ports, and exposed attack surfaces automatically.

What is the best way to automate subdomain discovery and port scanning for vulnerability assessment?▼

Automated subdomain discovery and port scanning accelerate vulnerability assessment by detecting exposed services. This Skill combines passive DNS, certificate transparency, and active port scanning with service detection to map large-scale web properties.

Can I use active scanning and service enumeration to find open ports on large-scale web properties?▼

Yes, active scanning and service enumeration detect open ports across large-scale web properties. You can scan the top 1000, 10000, or all ports while performing version detection, banner grabbing, and OS fingerprinting to identify exposed services.

Does domain reconnaissance require passive DNS and certificate transparency checks before brute-forcing?▼

Domain reconnaissance utilizes passive DNS and certificate transparency checks alongside DNS brute-forcing and zone transfers. This combination ensures comprehensive subdomain discovery without relying solely on active techniques that may trigger alerts.

What limitations should I expect when running active port scanning and API discovery?▼

Active port scanning and API discovery may trigger network alerts or rate limits on target systems. Because this Skill requires active scanning tools, operations should be authorized and configured carefully to avoid disruption during surface analysis.

Why does service enumeration matter for identifying an attack surface during reconnaissance?▼

Service enumeration identifies protocol-specific details and software versions that define the attack surface. By grabbing banners and detecting versions, this Skill exposes potential vulnerabilities before deeper vulnerability assessment begins.

Related Skills

Explore More Software Engineering Skills→
protoLabsAIprotoLabsAI
2

recon-sweep

Perform passive and scoped active reconnaissance on network targets and domains.

Official
Advanced
NickCrewNickCrew
29

owasp-top-10

Identify OWASP Top 10 security vulnerabilities in web applications.

Community
Advanced
lNwNllNwNl
2

recon-and-methodology

Build a systematic reconnaissance workflow mapping target assets into an actionable attack surface.

Community
Advanced
transilienceaitransilienceai
462

domain-assessment

Coordinate subdomain discovery and port scanning to build a domain attack surface inventory.

Official
Basic