skills.rest
cybersecwoman
cybersecwomanCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

web2-recon

Automate web2 asset, subdomain, and endpoint discovery for security assessments.

5|Updated May 27, 2026
Search Tags:#subdomain enumeration#web reconnaissance#url discovery#javascript analysis#directory fuzzing
One-click install
npx skills add https://github.com/cybersecwoman/Kiro-BugHunter --skill web2-recon-cybersecwoman
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: web2-recon
Source: https://github.com/cybersecwoman/Kiro-BugHunter/tree/main/skills/web2-recon
Command: npx skills add https://github.com/cybersecwoman/Kiro-BugHunter --skill web2-recon-cybersecwoman

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires subfinder, httpx, nuclei, katana, waybackurls, gau, ffuf, anew, gf, interactsh-client, nuclei-templates, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill automates the process of reconnaissance for web2 applications, identifying potential attack vectors and gathering intelligence for security assessments.

Core Features & Use Cases

  • Subdomain Enumeration: Utilizes multiple sources to find all subdomains of a target domain.
  • Live Host Discovery: Determines which subdomains are live and accessible.
  • URL Crawl and Analysis: Discovers URLs and performs analysis to identify potential entry points.
  • Directory Fuzzing: Tests directories for common vulnerabilities.
  • JS Analysis: Inspects JavaScript files for secrets and hidden endpoints.
  • Continuous Monitoring: Monitors for new subdomains and changes in the target application.
  • Use Case: When conducting a security assessment on a web application, this Skill can be used to quickly identify potential attack vectors and gather intelligence.

Quick Start

Use the web2-recon skill to perform reconnaissance on the target domain 'example.com'.

Frequently Asked Questions about web2-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate web reconnaissance and subdomain enumeration for a target domain?▼

Web reconnaissance automates subdomain discovery and live host detection using tools like subfinder and httpx. It enumerates target application assets, crawls URLs, and identifies potential attack vectors through both passive and active scanning stages.

What is the best way to find hidden endpoints and secrets in JavaScript files?▼

JavaScript analysis inspects JS files to extract hidden endpoints and embedded secrets. By crawling application URLs with tools like katana, you can dynamically map entry points and analyze scripts to uncover sensitive data exposure during security assessments.

Do I need to install external tools to perform directory fuzzing and URL discovery?▼

Directory fuzzing and URL discovery require external dependencies like ffuf, gau, and waybackurls. You must install these tools alongside subfinder, httpx, nuclei, and katana to execute the full automated reconnaissance workflow.

Can I continuously monitor for new subdomains on a target web application?▼

Continuous monitoring tracks new subdomains and application changes over time. By repeatedly running enumeration and live host discovery stages, you can detect newly exposed assets and update your target attack surface intelligence.

How does active scanning identify common vulnerabilities during web2 reconnaissance?▼

Active scanning identifies common vulnerabilities using nuclei templates against discovered hosts and endpoints. It validates live URLs and tests directories to detect security weaknesses, providing actionable intelligence for penetration testing.

Related Skills

Explore More Software Engineering Skills→
giosuetedeschi-specgiosuetedeschi-spec

Red Team Tools and Methodology

Automate web application reconnaissance and vulnerability discovery workflows.

Community
Advanced
ricardoo022ricardoo022

scan-fase-1

Identify configurations, secrets, and attack-surface exposure from JS-bundled web applications.

Community
Advanced
six2dezsix2dez
1.4k

burp-scan

Coordinate Burp Suite scans via MCP for vulnerability identification.

Community
Advanced
cxnaivecxnaive

web-pentest

Perform authorized web application penetration testing with reconnaissance, vulnerability analysis, and proof-based exploitation.

Community
Advanced