web2-recon

Discover subdomains, live hosts, and actionable URLs for web2 vulnerability hunting.

Updated Aug 23, 2026

Search Tags:#subdomain enumeration #vulnerability hunting #web2 recon #live host discovery #url crawling #js analysis #directory fuzzing

Ready to run

npx skills add https://github.com/AKasem1/claude-bug-bounty --skill web2-recon-akasem1

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: web2-recon
Source: https://github.com/AKasem1/claude-bug-bounty/tree/main/skills/web2-recon
Command: npx skills add https://github.com/AKasem1/claude-bug-bounty --skill web2-recon-akasem1

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It solves the problem of discovering a web2 target’s hidden attack surface quickly, so bug hunters can stop guessing and start validating real, in-scope findings.

Core Features & Use Cases

Asset discovery & prioritization: Enumerates subdomains and live hosts, then produces a prioritized URL set for testing.
URL crawling and parameter triage: Crawls current and historical URLs, then filters for high-value parameters, API routes, auth flows, uploads, and admin/internal paths.
Recon enrichment from JavaScript: Extracts candidate endpoints and secrets from JS bundles to expand what the crawler alone might miss.
Target scoring & monitoring readiness: Scores programs (go/no-go) and sets up continuous monitoring for new subdomains and changes.

Quick Start

Ask the AI to run web2 recon for target.com and return a folder with subdomains, live hosts, URLs, and a nuclei findings file.

Frequently Asked Questions about web2-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I discover hidden subdomains and live hosts for web2 vulnerability hunting?▼

Web2 recon automates subdomain enumeration and live host discovery to map a target's hidden attack surface. It probes multiple sources to identify active assets and produces a prioritized set of URLs for immediate vulnerability hunting and validation.

What is the best way to extract API endpoints and secrets from JavaScript bundles during recon?▼

JavaScript analysis extracts candidate endpoints and secrets directly from JS bundles to expand the attack surface beyond standard crawling. This recon enrichment reveals hidden API routes and parameters that automated URL crawlers might miss entirely.

How do I crawl historical URLs and filter for high-value parameters when mapping a target?▼

URL crawling collects both current and historical URLs, then filters for high-value targets like API routes, authentication flows, uploads, and admin paths. This parameter triage prioritizes actionable endpoints for focused vulnerability testing.

Can I run nuclei-based scanning directly after enumerating subdomains?▼

Yes, the process integrates nuclei-based scanning directly into the reconnaissance workflow. After enumerating subdomains and probing live hosts, it generates a dedicated nuclei findings file to identify known vulnerabilities across discovered web2 assets.

Does web2 attack surface mapping work for continuous monitoring of new subdomains?▼

Yes, target scoring and monitoring readiness setup support continuous mapping for new subdomains and asset changes. This allows bug hunters to track program scope dynamically and receive updated recon data without manually re-running the full enumeration pipeline.