skills.rest
YukiIto1999
YukiIto1999COMMUNITY
Explore all skills by this author →
GitHub

reconnaissance

Automates domain reconnaissance to inventory subdomains, ports, endpoints, and APIs.

Updated Apr 23, 2026
Search Tags:#reconnaissance#web-application#osint#port-scanning#api-discovery#subdomain#endpoint-enumeration
One-click install
npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill reconnaissance-yukiito1999
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: reconnaissance
Source: https://github.com/YukiIto1999/ctf-sleuth/tree/main/.claude/skills/reconnaissance
Command: npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill reconnaissance-yukiito1999

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Domain and web reconnaissance is time-consuming and error-prone; this Skill automates discovery of subdomains, open ports, API endpoints, and JavaScript routes to build a comprehensive attack-surface inventory.

Core Features & Use Cases

  • Subdomain discovery using passive and active methods, certificate transparency, and brute-force checks.
  • Port and service enumeration across commonly used ports to populate a precise asset map.
  • API and endpoint discovery including REST, GraphQL, and documentation to feed inventory and risk analysis.
  • Use Case: For a new web app, rapidly enumerate the attack surface to prioritize testing and hardening efforts.

Quick Start

Run reconnaissance on a target domain to generate subdomains, port and endpoint inventory, and API endpoints.

Frequently Asked Questions about reconnaissance

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate subdomain discovery and port scanning for web application reconnaissance?▼

Web application reconnaissance automates subdomain discovery and port scanning by leveraging tools like subfinder, amass, and nmap to inventory open ports and certificate transparency data into a structured attack surface map.

What is the best way to discover hidden API endpoints and JavaScript routes during a security assessment?▼

API and endpoint discovery identifies REST, GraphQL, and JavaScript routes by running directory brute-force checks with ffuf and gobuster, producing structured inventory artifacts for risk analysis and testing.

Can I use masscan and nmap together for rapid port discovery across multiple targets?▼

Yes, port and service enumeration across multiple targets integrates masscan for rapid port discovery and nmap for service validation, outputting a precise asset map for security assessments and red-team exercises.

Does this domain reconnaissance approach work for OSINT gathering and CTF setups?▼

Domain reconnaissance applies to OSINT gathering and CTF setups by using passive methods and certificate transparency to rapidly map subdomains, endpoints, and APIs without requiring active exploitation.

How do I process raw enumeration outputs into structured API and endpoint inventory for machine consumption?▼

Raw enumeration outputs from tools like ZAP and nikto are processed into structured inventory and analysis artifacts, formatting discovered APIs and endpoints for both human review and machine consumption.

Related Skills

Explore More Software Engineering Skills→
qa-amanqa-aman
19

pentest-scope

Define penetration testing engagement scope with targets, objectives, and authorization.

Community
Intermediate
Ed1s0nZEd1s0nZ
5.6k

network-penetration-testing

Execute network penetration testing phases with Nmap, Nessus, and Metasploit.

Community
Advanced
langbyyilangbyyi
96

graphql-and-hidden-parameters

Identify GraphQL API vulnerabilities including hidden parameters and authorization gaps.

Community
Advanced
giljaegiljae
1

benchmark

Assesses web page speed metrics and compares them with previous baselines.

Community
Intermediate