Verified:GitHub

web2-recon

Automate web2 reconnaissance with subdomain discovery, live host enumeration, URL crawling, and JavaScript bundle analysis.

Updated Jul 1, 2026

Search Tags:#vulnerability assessment #reconnaissance #subdomain enumeration #JavaScript analysis #web2

Ready to run

npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill web2-recon-bpnrockstar

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: web2-recon
Source: https://github.com/bpnrockstar/UnifiedBugHunter/tree/main/skills/web2-recon
Command: npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill web2-recon-bpnrockstar

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires subfinder, httpx, nuclei, katana, waybackurls, gau, ffuf, aunew, gf, interactsh-client, dalfox, python3, jq, sed, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill simplifies and accelerates the initial reconnaissance phase of a web2 security audit, providing a streamlined approach to subdomain enumeration, live host discovery, URL crawling, directory fuzzing, and JS analysis.

Core Features & Use Cases

Subdomain Enumeration: Aggregates subdomains from various sources to expand the attack surface.
Live Host Discovery: Identifies active hosts and services based on domain records.
URL Crawl and Fuzzing: Maps out URLs and discovers hidden directories and files.
JS Analysis: Inspects JavaScript bundles for vulnerabilities and hidden features.
Use Case: For security researchers or pentesters to quickly understand the scope and potential vulnerabilities of a web application.

Quick Start

Run the web2-recon skill for the target 'example.com' to perform an automated recon.

Frequently Asked Questions about web2-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate web2 reconnaissance for subdomain enumeration and vulnerability assessment?▼

Automate web2 reconnaissance by aggregating subdomains with subfinder, probing live hosts with httpx, and scanning for vulnerabilities with nuclei. This process maps the target's attack surface and identifies potential security flaws efficiently.

What is the best way to analyze JavaScript bundles for hidden vulnerabilities during a security audit?▼

Analyzing JavaScript bundles involves crawling target URLs with katana and extracting historical endpoints using waybackurls. This uncovers hidden directories, exposed API keys, and latent features within the application's JS files.

Do I need to install external tools like subfinder and nuclei to perform web2 recon?▼

Yes, performing web2 recon requires installing external dependencies including subfinder, httpx, nuclei, katana, ffuf, and dalfox. These tools are essential for executing automated subdomain discovery, URL crawling, and vulnerability detection.

Can I use this automated recon workflow for directory fuzzing on live web hosts?▼

Yes, you can perform directory fuzzing on live web hosts using ffuf. After live host discovery with httpx, the workflow maps out URLs and discovers hidden directories and files to expand the target's attack surface.

Why does my web2 reconnaissance workflow need tools like gau and waybackurls?▼

Tools like gau and waybackurls fetch archived and known URLs for the target domain. Integrating them into your web2 reconnaissance workflow ensures comprehensive URL crawling and reveals hidden endpoints that active scanning might miss.

When should I use automated subdomain enumeration instead of manual web2 mapping?▼

Use automated subdomain enumeration when you need to quickly understand the scope of a large web application. Automating reconnaissance with tools like subfinder and nuclei accelerates attack surface mapping compared to manual discovery methods.