Discover subdomains, live hosts, and actionable URLs for web2 vulnerability hunting.
npx skills add https://github.com/AKasem1/claude-bug-bounty --skill web2-recon-akasem1
Please help me install this Agent Skill. Skill: web2-recon Source: https://github.com/AKasem1/claude-bug-bounty/tree/main/skills/web2-recon Command: npx skills add https://github.com/AKasem1/claude-bug-bounty --skill web2-recon-akasem1
It solves the problem of discovering a web2 target’s hidden attack surface quickly, so bug hunters can stop guessing and start validating real, in-scope findings.
Ask the AI to run web2 recon for target.com and return a folder with subdomains, live hosts, URLs, and a nuclei findings file.
High-intent search queries and answers about installing and using this skill.
Web2 recon automates subdomain enumeration and live host discovery to map a target's hidden attack surface. It probes multiple sources to identify active assets and produces a prioritized set of URLs for immediate vulnerability hunting and validation.
JavaScript analysis extracts candidate endpoints and secrets directly from JS bundles to expand the attack surface beyond standard crawling. This recon enrichment reveals hidden API routes and parameters that automated URL crawlers might miss entirely.
URL crawling collects both current and historical URLs, then filters for high-value targets like API routes, authentication flows, uploads, and admin paths. This parameter triage prioritizes actionable endpoints for focused vulnerability testing.
Yes, the process integrates nuclei-based scanning directly into the reconnaissance workflow. After enumerating subdomains and probing live hosts, it generates a dedicated nuclei findings file to identify known vulnerabilities across discovered web2 assets.
Yes, target scoring and monitoring readiness setup support continuous mapping for new subdomains and asset changes. This allows bug hunters to track program scope dynamically and receive updated recon data without manually re-running the full enumeration pipeline.
musher-devGenerate milestone map documents defining project phases with exit criteria and sequencing.
ArianHobson333Automate exploit chain construction from validated findings for security testing.
AeonDaveFuzz HTTP endpoints with wordlists to discover directories, parameters, and virtual hosts.
wgpsecExtract API endpoints, keys, and internal domains from JavaScript bundles.
