Web Application Reconnaissance

Harvests and analyzes web app endpoints and metadata for reconnaissance workflows.

5|3|Updated Oct 13, 2025

Search Tags:#content discovery #endpoints #web-app #web reconnaissance #technology fingerprinting #JavaScript analysis

Ready to run

npx skills add https://github.com/macaugh/super-rouge-hunter-skills --skill web-application-reconnaissance

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: Web Application Reconnaissance
Source: https://github.com/macaugh/super-rouge-hunter-skills/tree/main/skills/reconnaissance/web-app-recon
Command: npx skills add https://github.com/macaugh/super-rouge-hunter-skills --skill web-application-reconnaissance

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Web application reconnaissance goes beyond subdomain discovery to map the full attack surface of a web application. This includes discovering hidden endpoints, analyzing client-side code, identifying backend technologies, and understanding the application's architecture.

Core Features & Use Cases

Tech fingerprinting: Identify technologies, frameworks, and server configurations using whatweb, HTTP headers analysis, and Wappalyzer.
Content and endpoint discovery: Locate hidden endpoints, admin panels, and forgotten files through directory brute-forcing and intelligent wordlists.
JavaScript analysis: Extract potential API endpoints and hardcoded secrets by analyzing client-side code and embedded data.
Use Case: Imagine you are assessing a recently discovered web application; you run the workflow to surface technologies, surface endpoints, and surface hidden paths for deeper testing.

Quick Start

Identify live target: whatweb -v -a 3 https://target.com
Retrieve obvious resources: curl -I https://target.com; curl -s https://target.com/robots.txt
Run content discovery: feroxbuster -u https://target.com -w /usr/share/wordlists/... -o output.json
Analyze JavaScript: katana -u https://target.com -jc -o crawl_js.txt
Compile findings: review discovered endpoints, technologies, and sensitive paths for deeper testing

Frequently Asked Questions about Web Application Reconnaissance

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I map a web application attack surface and find hidden endpoints?▼

Web application reconnaissance maps the attack surface by applying technology fingerprinting, content discovery, and JavaScript analysis to identify hidden endpoints, admin panels, and backend technologies for deeper testing.

What is the best way to discover forgotten or debug endpoints on live targets?▼

The best way to discover forgotten or debug endpoints is through content discovery using directory brute-forcing with intelligent wordlists and JavaScript analysis to extract hidden paths and embedded data.

How do I extract potential API endpoints and hardcoded secrets from client-side code?▼

To extract potential API endpoints and hardcoded secrets, perform JavaScript analysis on client-side code to parse embedded data and scripts, revealing sensitive paths and configurations.

Does web reconnaissance require tooling like whatweb, curl, and feroxbuster?▼

Yes, web reconnaissance requires tooling like whatweb, curl, and feroxbuster to perform technology fingerprinting, content discovery, and resource retrieval, delivering a comprehensive map of endpoints and weaknesses.

When do I need web application reconnaissance during an assessment?▼

You need web application reconnaissance during initial web app assessment or post-subdomain enumeration, as it goes beyond subdomain discovery to map the full attack surface, hidden endpoints, and backend technologies.