One-click install
npx skills add https://github.com/uphiago/recon-skills --skill visual-recon
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: visual-recon
Source: https://github.com/uphiago/recon-skills/tree/main/recon/visual-recon
Command: npx skills add https://github.com/uphiago/recon-skills --skill visual-recon

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Manually reviewing hundreds of live subdomains to identify high-value targets, default admin panels, and technology stacks is extremely time-consuming and impractical for large-scale reconnaissance efforts during authorized security assessments.

Core Features & Use Cases

  • Bulk Screenshot Capture: Automatically screenshot all alive hosts from a subdomain list to enable visual triage instead of manual browsing.
  • Technology Fingerprinting: Integrate with tools like httpx and whatweb to identify CMS, frameworks, and server types from captured screenshots and scan output.
  • Target Prioritization: Filter screenshots for high-value patterns like login pages, admin dashboards, default install pages, and error stack traces to focus testing efforts.
  • Use Case: For a target with 500+ alive subdomains, use this skill to quickly identify exposed phpMyAdmin panels, Jenkins dashboards, and WordPress install pages without opening each URL individually.

Quick Start

Use the visual-recon skill to screenshot all hosts in your alive subdomains list, filter for login and admin interfaces, and generate a prioritized list of high-value targets for further security testing.

Frequently Asked Questions about visual-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate bulk screenshot capture for subdomain reconnaissance?

Automating bulk screenshot capture for subdomain reconnaissance requires gowitness and httpx to capture screenshots of alive hosts, extract page metadata, and integrate with fingerprinting tools for target scoring.

What is the best way to identify default admin panels across hundreds of live subdomains?

The best way to identify default admin panels across live subdomains is bulk screenshot capture for visual triage, filtering screenshots for login pages, admin dashboards, and default install pages without manual browsing.

How does visual triage work for target prioritization in penetration testing?

Visual triage for target prioritization works by capturing screenshots of all alive hosts, filtering for high-value patterns like exposed dashboards and error stack traces, and generating a prioritized list for further security testing.

Do I need python3 and headless browser support for technology fingerprinting?

Yes, python3 with headless browser support is required for technology fingerprinting, alongside gowitness and httpx, to capture screenshots, extract page metadata, and identify CMS, frameworks, and server types.

Can I use this approach to find exposed phpMyAdmin panels and Jenkins dashboards?

Yes, you can use bulk screenshot capture to quickly identify exposed phpMyAdmin panels, Jenkins dashboards, and WordPress install pages across large host sets without opening each URL individually.

What limitations exist when using gowitness for large-scale visual triage?

Gowitness for large-scale visual triage requires proper headless browser support and python3 configuration, and is limited to processing alive hosts from your subdomain list for visual inspection and metadata extraction.