reconnaissance

Name: reconnaissance
Availability: InStock
Author: hoanghn61

Enumerate subdomains, ports, endpoints, and JavaScript routes into a structured attack-surface inventory.

Updated May 27, 2026

Search Tags:#reconnaissance #API discovery #port scanning #attack surface #subdomain discovery #endpoint enumeration #vulnerability planning

Ready to run

npx skills add https://github.com/hoanghn61/.agents --skill reconnaissance-hoanghn61

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: reconnaissance
Source: https://github.com/hoanghn61/.agents/tree/main/skills/reconnaissance
Command: npx skills add https://github.com/hoanghn61/.agents --skill reconnaissance-hoanghn61

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It reduces the time and guesswork required to discover external-facing systems by turning scattered public information and scan results into a structured attack-surface inventory.

Core Features & Use Cases

Subdomain and service discovery: Find live subdomains, open ports, and identify services and versions to establish what is exposed.
Web and API mapping: Enumerate directories/files, discover REST/GraphQL/SOAP/WebSocket endpoints, and extract Swagger/OpenAPI-documented attack paths.
JavaScript/SPA route discovery and prioritization: Identify client-side routes and group findings into risk-ordered surfaces for efficient follow-up testing.

Quick Start

Use the reconnaissance skill to generate an attack-surface inventory for a target domain by subdomain discovery, port scanning, endpoint enumeration, and analysis output.

Frequently Asked Questions about reconnaissance

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I map an external attack surface across domains and web apps?▼

To map an external attack surface, you perform passive-first domain reconnaissance to enumerate live subdomains, scan open ports, and identify exposed services. This process yields a structured inventory of externally reachable systems and validated attack paths.

What is passive-first subdomain discovery and why is it needed for security assessments?▼

Passive-first subdomain discovery uses public information sources to find subdomains without actively querying the target. It is needed to respect rate limits and minimize detection during security assessments before validating that subdomains are live for active port scanning.

How do I discover REST, GraphQL, and WebSocket endpoints for vulnerability planning?▼

To discover REST, GraphQL, and WebSocket endpoints for vulnerability planning, you enumerate web directories and extract Swagger or OpenAPI documentation. This identifies exposed API attack paths and JavaScript SPA client-side routes for prioritized risk analysis.

Can I extract JavaScript and SPA routes during attack surface reconnaissance?▼

Yes, you can extract JavaScript and SPA routes during attack surface reconnaissance to identify client-side routes. Mapping these routes groups findings into risk-ordered surfaces, enabling efficient and prioritized follow-up vulnerability testing workflows.

What is the best way to inventory exposed services and open ports?▼

The best way to inventory exposed services and open ports is to validate that enumerated subdomains are live before scanning, respecting rate limits. This approach saves raw tool outputs while producing a structured inventory and risk analysis of discovered services and application versions.

Does attack surface discovery require validating live subdomains before port scanning?▼

Yes, attack surface discovery requires validating that subdomains are live before port scanning. This constraint ensures scanning resources target active externally reachable systems, respects rate limits, and avoids wasting effort on inactive subdomain DNS records.