web2-recon

Automate web2 reconnaissance with subdomain enumeration, live host discovery, and URL collection.

13|2|Updated Jun 1, 2026
One-click install
npx skills add https://github.com/chatbotkit/rook --skill web2-recon-chatbotkit
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: web2-recon
Source: https://github.com/chatbotkit/rook/tree/main/skills/web2-recon
Command: npx skills add https://github.com/chatbotkit/rook --skill web2-recon-chatbotkit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Reconnaissance for web2 targets is time-consuming and error-prone when manually aggregating subdomains, live hosts, and potential endpoints across multiple tools. This skill bundles discovery, mapping, and continuous monitoring into a repeatable workflow.

Core Features & Use Cases

  • Subdomain enumeration across multiple sources (subfinder, Chaos API, assetfinder) to build a comprehensive surface map.
  • Live host discovery and URL collection (dnsx, httpx, katana, waybackurls, gau) for rapid asset inventory.
  • JS analysis and ongoing monitoring for changes (LinkFinder, SecretFinder, new subdomain alerts, GitHub commit watch).
  • Use Case: Start a web2 reconnaissance on a new target and hand off a prioritized asset list (subdomains.txt, live-hosts.txt, urls.txt) for triage and testing.

Quick Start

Start by exporting or setting your TARGET (e.g., example.com) and run the web2 recon pipeline to generate subdomains, live hosts, and URLs.

Frequently Asked Questions about web2-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate web2 reconnaissance for subdomain enumeration and live host discovery?

Automate web2 reconnaissance by coordinating subdomain enumeration, live host discovery, and URL collection into a repeatable pipeline. It aggregates subdomains, live hosts, and endpoints into grouped text files for downstream triage and testing.

What is the best way to map an attack surface for a new web2 target?

Mapping an attack surface for a new web2 target is done by running a coordinated pipeline that aggregates subdomains, live hosts, and URLs. This discovers and inventories assets to hand off a prioritized list for hunting.

How do I collect URLs and endpoints from JavaScript files during recon?

Collect URLs and endpoints from JavaScript files using LinkFinder and SecretFinder within the recon pipeline. These tools analyze JS files to extract hidden paths and secrets, adding them to your urls.txt output.

Can I use subfinder and httpx together for asset discovery and inventory?

You can use subfinder and httpx together for asset discovery and inventory. The pipeline coordinates subfinder for subdomain enumeration and httpx for live host discovery, outputting grouped results for rapid asset inventory.

How does continuous monitoring work for new subdomains and GitHub commits?

Continuous monitoring for new subdomains and GitHub commits works by applying JS analysis and ongoing watch configurations. It alerts you to new subdomain additions and GitHub commit changes to track evolving attack surfaces.

What tools are needed for a comprehensive subdomain enumeration and URL crawling pipeline?

A comprehensive subdomain enumeration and URL crawling pipeline requires tools like subfinder, Chaos API, assetfinder, dnsx, httpx, katana, waybackurls, and gau. These are coordinated automatically to output grouped asset lists.