web-recon

Web reconnaissance automation gathers HTTP headers, robots.txt, sitemaps, sensitive files, open ports, and technology fingerprints across target applications using tools like curl, nmap, gobuster, and whatweb. This reveals the full attack surface for penetration testing and security assessments without manual enumeration.

Technology stack fingerprinting identifies the web server, frameworks, libraries, and services running on a target through HTTP headers, response patterns, and directory structures. Combined with port scanning and directory discovery, it builds a complete profile of exposed technologies and versions to guide vulnerability assessment.

Directory scanning with tools like gobuster, ffuf, and dirsearch automates discovery of hidden paths, configuration files, backups, and sensitive endpoints. Web reconnaissance identifies common locations—robots.txt, sitemap.xml, admin panels—and brute-forces non-obvious directories to expose the full application structure.

Port scanning with nmap identifies open services and protocols across the target infrastructure, revealing web servers, databases, and auxiliary services that expand the attack surface. Combined with HTTP header analysis and service fingerprinting, it prioritizes which services warrant deeper security testing.

Passive reconnaissance gathers public data—DNS records, cached pages—without touching the target. Active reconnaissance sends requests directly: HTTP headers, directory scanning, port probes. This Skill performs active reconnaissance using Bash automation and common tooling to enumerate the complete, current attack surface.

Web reconnaissance uses standard Linux tools: curl for HTTP requests, nmap for port scanning, gobuster and ffuf for directory discovery, whatweb for fingerprinting. Bash automation orchestrates these tools into a repeatable workflow without requiring commercial or proprietary scanning platforms.