skills.rest
macaugh
macaughCOMMUNITY
Explore all skills by this author →
GitHub

Web Application Reconnaissance

Harvests and analyzes web app endpoints and metadata for reconnaissance workflows.

5|3|Updated Oct 13, 2025
Search Tags:#content discovery#endpoints#web-app#web reconnaissance#technology fingerprinting#JavaScript analysis
One-click install
npx skills add https://github.com/macaugh/super-rouge-hunter-skills --skill web-application-reconnaissance
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Web Application Reconnaissance
Source: https://github.com/macaugh/super-rouge-hunter-skills/tree/main/skills/reconnaissance/web-app-recon
Command: npx skills add https://github.com/macaugh/super-rouge-hunter-skills --skill web-application-reconnaissance

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Web application reconnaissance goes beyond subdomain discovery to map the full attack surface of a web application. This includes discovering hidden endpoints, analyzing client-side code, identifying backend technologies, and understanding the application's architecture.

Core Features & Use Cases

  • Tech fingerprinting: Identify technologies, frameworks, and server configurations using whatweb, HTTP headers analysis, and Wappalyzer.
  • Content and endpoint discovery: Locate hidden endpoints, admin panels, and forgotten files through directory brute-forcing and intelligent wordlists.
  • JavaScript analysis: Extract potential API endpoints and hardcoded secrets by analyzing client-side code and embedded data.
  • Use Case: Imagine you are assessing a recently discovered web application; you run the workflow to surface technologies, surface endpoints, and surface hidden paths for deeper testing.

Quick Start

  1. Identify live target: whatweb -v -a 3 https://target.com
  2. Retrieve obvious resources: curl -I https://target.com; curl -s https://target.com/robots.txt
  3. Run content discovery: feroxbuster -u https://target.com -w /usr/share/wordlists/... -o output.json
  4. Analyze JavaScript: katana -u https://target.com -jc -o crawl_js.txt
  5. Compile findings: review discovered endpoints, technologies, and sensitive paths for deeper testing

Frequently Asked Questions about Web Application Reconnaissance

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I map a web application attack surface and find hidden endpoints?▼

Web application reconnaissance maps the attack surface by applying technology fingerprinting, content discovery, and JavaScript analysis to identify hidden endpoints, admin panels, and backend technologies for deeper testing.

What is the best way to discover forgotten or debug endpoints on live targets?▼

The best way to discover forgotten or debug endpoints is through content discovery using directory brute-forcing with intelligent wordlists and JavaScript analysis to extract hidden paths and embedded data.

How do I extract potential API endpoints and hardcoded secrets from client-side code?▼

To extract potential API endpoints and hardcoded secrets, perform JavaScript analysis on client-side code to parse embedded data and scripts, revealing sensitive paths and configurations.

Does web reconnaissance require tooling like whatweb, curl, and feroxbuster?▼

Yes, web reconnaissance requires tooling like whatweb, curl, and feroxbuster to perform technology fingerprinting, content discovery, and resource retrieval, delivering a comprehensive map of endpoints and weaknesses.

When do I need web application reconnaissance during an assessment?▼

You need web application reconnaissance during initial web app assessment or post-subdomain enumeration, as it goes beyond subdomain discovery to map the full attack surface, hidden endpoints, and backend technologies.

Related Skills

Explore More Software Engineering Skills→
Mikacr1138Mikacr1138
2

web2-recon

Automate web2 reconnaissance from subdomain enumeration to JS analysis.

Community
Intermediate
yhy0yhy0
74

ghsa-skill-builder

Generate security vulnerability Skills from GHSA and HackerOne reports.

Community
Advanced
jcastillotxjcastillotx

Ethical Hacking Methodology

Execute a complete penetration testing lifecycle from reconnaissance to reporting.

Community
Advanced
davpatel605-beepdavpatel605-beep

web-pentest

Perform authorized web application penetration testing with structured vulnerability classification and reporting.

Community
Advanced