skills.rest
0xhaaz
0xhaazCOMMUNITY
Explore all skills by this author →
𝕏@0xhaazGitHub

web2-recon

Run web2 reconnaissance pipelines for subdomain enumeration, live host detection, and URL crawling.

1|Updated Jun 22, 2026
Search Tags:#vulnerability assessment#subdomain enumeration#web reconnaissance#JavaScript analysis#directory fuzzing#URL crawling#live host detection
One-click install
npx skills add https://github.com/0xhaaz/bug-bounty-toolkit --skill web2-recon-0xhaaz
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: web2-recon
Source: https://github.com/0xhaaz/bug-bounty-toolkit/tree/main/skills/web2-recon
Command: npx skills add https://github.com/0xhaaz/bug-bounty-toolkit --skill web2-recon-0xhaaz

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires subfinder, chaosapi, nuclei, katana, waybackurls, gau, ffuf, linkfinder, secretfinder, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill provides a robust, step-by-step web2 reconnaissance pipeline to identify potential vulnerabilities in a target website, including asset discovery, subdomain enumeration, live host detection, URL crawling, directory fuzzing, and JavaScript analysis.

Core Features & Use Cases

  • Asset Discovery: Enumerates subdomains, identifies live hosts, and crawls URLs for a comprehensive asset inventory.
  • Subdomain Enumeration: Utilizes subfinder, Chaos API, and assetfinder to uncover potential subdomains.
  • Live Host Detection: Performs DNS resolution and HTTP checks to identify active hosts.
  • URL Crawling: Utilizes katana, waybackurls, and gau to crawl and discover URLs.
  • Directory Fuzzing: Uses ffuf to fuzz directories and find hidden resources.
  • JavaScript Analysis: Employ LinkFinder and SecretFinder to analyze JavaScript files for hidden endpoints and secrets.
  • Use Case: When beginning reconnaissance on a web2 target, use this Skill to identify potential entry points for further analysis.

Quick Start

Use the web2-recon skill to initiate a full reconnaissance on 'target.com'.

Frequently Asked Questions about web2-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate web reconnaissance for subdomain enumeration and live host detection?▼

Automate web reconnaissance by running a pipeline that uses subfinder and Chaos API for subdomain enumeration, then performs DNS resolution and HTTP checks for live host detection on the target website.

What is the best way to crawl URLs and fuzz directories during vulnerability assessment?▼

The best way to crawl URLs and fuzz directories is using katana, waybackurls, and gau for URL discovery, paired with ffuf for directory fuzzing to uncover hidden resources on the target.

How do I analyze JavaScript files for hidden endpoints and secrets?▼

Analyze JavaScript files for hidden endpoints and secrets by employing LinkFinder and SecretFinder to parse and extract sensitive data from JS assets discovered during the URL crawling phase.

Do I need external tools and APIs to perform comprehensive web2 reconnaissance?▼

Yes, comprehensive web2 reconnaissance requires external tools and services like subfinder, Chaos API, nuclei, katana, waybackurls, gau, ffuf, LinkFinder, and SecretFinder to execute the full pipeline.

Can I use this pipeline for vulnerability assessment on a specific target website?▼

Yes, you can use this pipeline for vulnerability assessment by initiating a full reconnaissance on a target website to identify potential entry points, assets, and vulnerabilities for further analysis.

What are the limitations of using automated URL crawling for asset discovery?▼

Automated URL crawling using tools like waybackurls and gau relies on historical data and passive sources, meaning it may miss newly created endpoints, dynamically generated links, or resources blocked from crawling.

Related Skills

Explore More Software Engineering Skills→
infantesromeroadrianinfantesromeroadrian

web2-recon

Automate web2 reconnaissance with subdomain enumeration, live host discovery, and vulnerability scanning.

Community
Advanced
ArianHobson333ArianHobson333
7

web2-recon

Automate web2 reconnaissance with subdomain enumeration, URL crawling, and fuzzing.

Community
Advanced
rafaelcallejarafaelcalleja
2

ffuf-web-fuzzing

Fuzz web resources to discover hidden directories, files, and subdomains.

Community
Advanced
transilienceaitransilienceai
462

domain-assessment

Coordinate subdomain discovery and port scanning to build a domain attack surface inventory.

Official
Basic