What problem does it solve?
Reconnaissance for web2 targets is time-consuming and error-prone when manually aggregating subdomains, live hosts, and potential endpoints across multiple tools. This skill bundles discovery, mapping, and continuous monitoring into a repeatable workflow.
Core Features & Use Cases
- Subdomain enumeration across multiple sources (subfinder, Chaos API, assetfinder) to build a comprehensive surface map.
- Live host discovery and URL collection (dnsx, httpx, katana, waybackurls, gau) for rapid asset inventory.
- JS analysis and ongoing monitoring for changes (LinkFinder, SecretFinder, new subdomain alerts, GitHub commit watch).
- Use Case: Start a web2 reconnaissance on a new target and hand off a prioritized asset list (subdomains.txt, live-hosts.txt, urls.txt) for triage and testing.
Quick Start
Start by exporting or setting your TARGET (e.g., example.com) and run the web2 recon pipeline to generate subdomains, live hosts, and URLs.