skills.rest
LeoWSY-hashblue
LeoWSY-hashblueCOMMUNITY
Explore all skills by this author →
GitHub

reconnaissance

Aggregate subdomains, ports, endpoints, and APIs into structured inventories.

3|1|Updated May 26, 2026
Search Tags:#reconnaissance#web-security#pentest#port-scanning#attack-surface#subdomain-enumeration#api-discovery
One-click install
npx skills add https://github.com/LeoWSY-hashblue/-communitytools-custom --skill reconnaissance-leowsy-hashblue
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: reconnaissance
Source: https://github.com/LeoWSY-hashblue/-communitytools-custom/tree/main/skills/reconnaissance
Command: npx skills add https://github.com/LeoWSY-hashblue/-communitytools-custom --skill reconnaissance-leowsy-hashblue

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Domain assessment and web application mapping to identify subdomains, ports, endpoints, and APIs for accurate threat modeling and testing.

Core Features & Use Cases

  • Subdomain discovery from passive and active sources
  • Port and service enumeration to build a live inventory
  • Web application mapping including API discovery and JavaScript route discovery
  • Use Case: security testers create a comprehensive surface map for pentests or bug bounty programs.

Quick Start

Run reconnaissance on a target domain to produce a live subdomain inventory, port list, and API endpoints.

Frequently Asked Questions about reconnaissance

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I map the web-facing attack surface of a target domain?▼

To map an attack surface, you need to aggregate subdomains, ports, endpoints, and APIs. Reconnaissance automates this discovery process to build a comprehensive live inventory for threat modeling and pentest scenarios.

What is subdomain enumeration and when do I need it for pentesting?▼

Subdomain enumeration discovers underlying hostnames from passive and active sources. You need it during the reconnaissance phase of a pentest to reveal unmonitored entry points and accurately scope your target domain space.

How do I discover live hosts and API endpoints for risk assessment?▼

Discover live hosts and API endpoints by running port and service enumeration alongside web application mapping. This reveals active infrastructure and JavaScript routes, delivering structured outputs for risk assessment.

Can I automate attack surface discovery for bug bounty programs?▼

Yes, you can automate attack surface discovery by leveraging the frontmatter-driven entry point. This allows security testers to systematically inventory target domains and reveal API surfaces for bug bounty programs.

Does this reconnaissance approach require external dependencies or tools?▼

No external dependencies are required to run this reconnaissance approach. It operates independently to aggregate domain space, enumerate live hosts, and map web-facing attack surfaces without needing prior tool installations.

Related Skills

Explore More Software Engineering Skills→
zebbernzebbern
4.5k

IDOR Vulnerability Testing

Identify and exploit IDOR vulnerabilities in web applications.

Community
Advanced
z1439527767z1439527767

security-audit

Organize security auditing workflows for vulnerability identification and remediation planning.

Community
Advanced
matteocervellimatteocervelli
25

vulnerability-assessor

Assess software vulnerabilities with CVSS scoring and remediation planning.

Community
Advanced
ArianHobson333ArianHobson333
7

reconnaissance

Identify subdomains, ports, endpoints, APIs, and attack surfaces.

Community
Advanced