redteam-recon-enterprise

Name: redteam-recon-enterprise
Availability: InStock
Author: chenchunrun

Automate enterprise reconnaissance to map assets, tech stacks, and attack surfaces.

1|1|Updated Apr 25, 2026

Search Tags:#automation #reconnaissance #enterprise #port-scan #subdomain #redteam

Ready to run

npx skills add https://github.com/chenchunrun/onyx-soc --skill redteam-recon-enterprise

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: redteam-recon-enterprise
Source: https://github.com/chenchunrun/onyx-soc/tree/main/skills/redteam-recon-enterprise
Command: npx skills add https://github.com/chenchunrun/onyx-soc --skill redteam-recon-enterprise

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, rich, and includes scripts (resource) components.

What problem does it solve?

企业级目标侦察面临资产分散、侦察成本高、周期长等痛点。本 Skill 提供自动化的资产发现、技术栈识别和攻击面测绘能力，帮助安全团队高效获取目标画像。

Core Features & Use Cases

自动化资产发现：映射子域名、IP、云资产，降低人工侦察成本。
技术栈识别与指纹：识别 Web 技术栈、框架与服务指纹，帮助快速定位风险点。
攻击面测绘与输出：生成侦察报告，便于渗透测试与安全评估落地。
Use Case: 在对目标企业进行全面情报收集时，结合阶段性输出报告和阶段性验证来支持决策。

Quick Start

对目标域名执行完整的企业侦察并输出结构化报告。

Frequently Asked Questions about redteam-recon-enterprise

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate enterprise reconnaissance to map subdomains and port scan an attack surface?▼

Enterprise reconnaissance is automated by mapping assets, enumerating subdomains, scanning ports, and fingerprinting technology stacks to produce structured attack surface reports. This multi-phase approach reduces manual target intake and scanning costs.

What is the best way to identify an organization's tech stack and web fingerprints during security assessments?▼

Identifying a tech stack is best handled by automated technology fingerprinting, which detects web frameworks and services across target assets. This process maps the organization's web technology stack to help quickly locate risk points.

Can I execute subdomain enumeration and SSL checks locally for internal red team workflows?▼

Subdomain enumeration and SSL checks can execute via local scripts with safe defaults for internal red team workflows. The modular design supports MCP-enabled workflows and local-script execution to output structured reconnaissance data.

Do I need specific Python dependencies to run automated enterprise port scanning and asset discovery?▼

Automated enterprise port scanning and asset discovery requires the Python requests and rich libraries. These dependencies support multi-phase target intake and structured output generation for the reconnaissance scripts.

How does automated attack surface mapping handle multi-phase target intake for security teams?▼

Automated attack surface mapping handles multi-phase target intake by sequentially processing domains, scanning ports, and checking SSL certificates. It generates structured outputs and phased reports to support penetration testing and security evaluation decisions.

What are the limitations of using automated reconnaissance for mapping enterprise cloud assets?▼

Automated reconnaissance for mapping enterprise cloud assets is limited by its scope of subdomain enumeration, port scanning, and SSL checks. It is designed for safe defaults and structured output, meaning heavy intrusive exploitation is not its primary function.