skills.rest
ajtazer
ajtazerCOMMUNITY
Explore all skills by this author →
Website𝕏@aj_tazerGitHub

web2-recon

Automate web2 reconnaissance from asset discovery to JS analysis.

Updated Apr 8, 2026
Search Tags:#subdomain enumeration#asset discovery#web2 recon#live host discovery#url crawling#js analysis
One-click install
npx skills add https://github.com/ajtazer/briyani-hunter --skill web2-recon-ajtazer
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: web2-recon
Source: https://github.com/ajtazer/briyani-hunter/tree/main/.gemini/skills/web2-recon
Command: npx skills add https://github.com/ajtazer/briyani-hunter --skill web2-recon-ajtazer

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Web2 reconnaissance can be time-consuming and error-prone due to the need to stitch together multiple tools for subdomain discovery, live host lookup, URL crawling, and JS analysis; this skill automates that workflow to surface the attack surface quickly.

Core Features & Use Cases

  • Subdomain enumeration using subfinder, Chaos API, and assetfinder to reveal potential targets.
  • Live host discovery with dnsx and httpx to determine reachable endpoints.
  • URL crawling via katana, waybackurls, and gau to expand the surface with historical and current pages.
  • Directory fuzzing with ffuf to identify hidden resources and endpoints.
  • JS analysis with LinkFinder and SecretFinder to extract client-side secrets and endpoints.
  • Continuous monitoring for new subdomains, JS changes, and GitHub commits to keep assets up to date.

Quick Start

Start the recon by pointing this skill at a target; it will generate a structured recon directory under recon/<target> containing subdomains, live hosts, URLs, and findings.

Frequently Asked Questions about web2-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate web2 reconnaissance from subdomain enumeration to JS analysis?▼

Web2 recon automation orchestrates subfinder, httpx, katana, and LinkFinder to map the attack surface end-to-end. You point it at a target, and it outputs a structured directory containing discovered subdomains, live hosts, crawled URLs, and extracted JS findings.

What is the best way to discover live hosts and crawl URLs for a web2 target?▼

Live host discovery and URL crawling are handled by running dnsx and httpx to find reachable endpoints, then katana, waybackurls, and gau expand the surface with historical and current pages. This produces structured URL data ready for further hunting.

How does JS analysis find client-side secrets and hidden endpoints?▼

JS analysis extracts client-side secrets and endpoints by running LinkFinder and SecretFinder against crawled JavaScript files. This reveals sensitive data and hidden API routes embedded in the client-side code, mapping deeper attack surface areas.

Can I use directory fuzzing alongside subdomain enumeration during web2 recon?▼

Subdomain enumeration and directory fuzzing run sequentially within the same workflow. After tools like subfinder and Chaos API reveal subdomains, ffuf performs directory fuzzing against the discovered live hosts to identify hidden resources and endpoints.

Do I need to manually monitor for new subdomains and JS changes after initial recon?▼

Continuous monitoring automates tracking for new subdomains, JS changes, and GitHub commits. This keeps asset records up to date without manual intervention, ensuring your attack surface map reflects the latest target modifications over time.

What limitations should I expect when stitching together tools for web2 recon?▼

Stitching together multiple tools for web2 recon is time-consuming and error-prone due to manual integration. Automation solves this by orchestrating the tools into a single workflow, though initial setup requires pointing the orchestration at the correct target.

Related Skills

Explore More Data & Analytics Skills→
matthew-johnsonmatthew-johnson

domain-intel

Identify passive domain intelligence data using Python standard library without external APIs.

Community
Intermediate
zebbernzebbern
4.5k

Red Team Tools and Methodology

Automate red-team reconnaissance and vulnerability discovery workflows.

Community
Advanced
cajiascajias

pr-monitor

Monitor GitHub pull requests for new commits and resume review workflows.

Community
Advanced
Mikacr1138Mikacr1138
2

web2-recon

Automate web2 reconnaissance from subdomain enumeration to JS analysis.

Community
Intermediate