skills.rest
dbx0
dbx0COMMUNITY
Explore all skills by this author →
WebsiteGitHub

web2-recon

Maps web application attack surfaces through subdomain enumeration, JS bundle analysis, and endpoint discovery.

7|4|Updated Jun 22, 2026
Search Tags:#reconnaissance#subdomain enumeration#attack surface#osint#bug bounty#api discovery#js bundle analysis
One-click install
npx skills add https://github.com/dbx0/skills --skill web2-recon-dbx0
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: web2-recon
Source: https://github.com/dbx0/skills/tree/main/skills/recon-osint/reconnaissance/web2-recon
Command: npx skills add https://github.com/dbx0/skills --skill web2-recon-dbx0

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Starting recon on a web target often yields incomplete asset inventories because standard subdomain wordlists miss documentation portals, API specs, and internal endpoints, leading to untested attack surface and false positives from SPA catch-all routes. ## Core Features & Use Cases - Full Asset Discovery Pipeline: Enumerate subdomains via subfinder, crt.sh, and DNS brute-forcing, then probe live hosts, crawl URLs, and fingerprint frameworks (Laravel, Next.js, Vercel, cPanel/WHM, Convex, Firebase). - JS Bundle and API Analysis: Extract hidden endpoints, Sentry route manifests, Auth0/OIDC configurations, and hardware specs from frontend bundles, plus test internal API prefixes like /internal/* for missing authentication. - False-Positive Elimination: Validate findings by content signature (e.g., .git/HEAD must contain 'ref: refs/') rather than HTTP status codes, with baseline comparison against random nonexistent paths. - Use Case: During a bug bounty engagement against a Next.js SaaS, use the pipeline to discover an unauthenticated /api/clients endpoint leaking thousands of PII records, then extract the data with adaptive rate-limit backoff and checkpoint saving. ## Quick Start Run full recon on target.com including subdomain enumeration, live host probing, JS bundle analysis, and a content-validated .git/.env exposure sweep.

Frequently Asked Questions about web2-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find subdomains when subfinder returns nothing?▼

Query crt.sh certificate transparency logs with a wildcard pattern and parse the JSON name_value fields. This catches new deployments and uncrawled infrastructure that passive DNS sources miss, though crt.sh rate-limits after roughly 10 requests per minute.

How to avoid false positives when scanning for exposed .git and .env files?▼

Validate responses by content signature instead of status code, since SPA routers return 200 with index.html for any path. Require patterns like 'ref: refs/' for .git/HEAD or KEY=VALUE lines for .env, and baseline each host against a random nonexistent path first.

What does Cloudflare error 1010 mean versus 525?▼

Error 1010 is WAF bot detection, often bypassable with a browser User-Agent string. Error 525 is an SSL handshake failure at the origin, indicating server misconfiguration rather than bot blocking, and may allow direct IP access.

Can I test POST endpoints during the recon phase?▼

No, recon is strictly read-only using GET, HEAD, and OPTIONS requests. Mutating endpoints with POST, PUT, PATCH, or DELETE is prohibited unless the user explicitly authorizes testing a specific action.

How do I extract data from a rate-limited paginated API?▼

Use the largest supported pageSize to reduce request count, apply adaptive backoff that increases delay on HTTP 429 and decreases on success, and checkpoint results every few hundred records so partial extraction survives timeouts.

Why does my session cookie fail on API endpoints after login?▼

Web session cookies often do not work for API routes, which may expect Bearer tokens or API keys instead. Compare error messages between cookie and Bearer authentication attempts to determine which mechanism the API recognizes.

Related Skills

Explore More Software Engineering Skills→
mtsatryanmtsatryan
1

penetration-tester

Identify and enumerate security weaknesses through authorized penetration testing.

Community
Advanced
kaminocorpkaminocorp
1

exploit-development

Develops proof-of-concept exploits for verified vulnerabilities in authorized security testing.

Official
Advanced
balsm-healthbalsm-health
2

analyzing-email-headers-for-phishing-investigation

Parse email headers and validate SPF, DKIM, and DMARC records.

Official
Advanced
protoLabsAIprotoLabsAI
2

recon-sweep

Perform passive and scoped active reconnaissance on network targets and domains.

Official
Advanced