skills.rest
elementalsouls
elementalsoulsCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

web2-recon

Automates web asset discovery and surface mapping using standard recon tools.

3.3k|507|Updated May 5, 2026
Search Tags:#subdomain-enumeration#recon#asset-discovery#url-crawling#js-analysis#web2#live-hosts
One-click install
npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill web2-recon-elementalsouls
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: web2-recon
Source: https://github.com/elementalsouls/Claude-BugHunter/tree/main/skills/web2-recon
Command: npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill web2-recon-elementalsouls

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Suboptimal web2 reconnaissance often yields scattered assets, stale subdomains, and incomplete attack surface maps. This Skill automates web2 asset discovery and surface mapping to provide a prioritized URL list for hunting.

Core Features & Use Cases

  • Subdomain enumeration: using subfinder, Chaos API, and assetfinder to surface candidates.
  • Live-host discovery: dnsx/httpx to identify reachable hosts and basic tech stack indicators.
  • URL crawling: katana, waybackurls, gau to build a comprehensive URL set.
  • Directory fuzzing: ffuf to enumerate endpoints and potential V1 paths.
  • JS analysis: LinkFinder and SecretFinder to extract endpoints and secrets from bundles.
  • Continuous monitoring: alerts for new subdomains, JS changes, and GitHub commit activity to keep assets up to date.

Quick Start

Describe your target and testing objective in plain English to load the web2-recon pipeline automatically.

Frequently Asked Questions about web2-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate subdomain enumeration and live host discovery for web2 targets?▼

Automate web2 subdomain enumeration and live host discovery by chaining subfinder, Chaos API, and assetfinder for candidates, then resolving reachable hosts with dnsx and httpx.

What is the best way to extract endpoints and secrets from JavaScript bundles during recon?▼

Extract endpoints and secrets from JavaScript bundles during recon by running LinkFinder and SecretFinder against crawled URLs to parse hidden paths and sensitive data.

How do I build a comprehensive URL list for attack surface mapping using waybackurls and gau?▼

Build a comprehensive URL list for attack surface mapping by passing live hosts through katana, waybackurls, and gau to aggregate historical and actively crawled endpoints.

Do I need a Chaos API key to run this web2 reconnaissance pipeline?▼

Yes, a Chaos API key is required to run this web2 reconnaissance pipeline, alongside the standard tooling suite including subfinder, dnsx, httpx, katana, and ffuf.

Can I set up continuous monitoring for new subdomains and JavaScript changes?▼

Yes, continuous monitoring alerts for new subdomains, JavaScript changes, and GitHub commit activity to keep your web2 asset attack surface maps up to date automatically.

How do I fuzz directories and potential V1 paths after URL crawling?▼

Fuzz directories and potential V1 paths after URL crawling by feeding discovered live hosts into ffuf to enumerate hidden endpoints and expand the target surface.

Related Skills

Explore More Software Engineering Skills→
chatbotkitchatbotkit
13

web2-recon

Automate web2 reconnaissance with subdomain enumeration, live host discovery, and URL collection.

Official
Advanced
dreadnodedreadnode
11

vuln-critic

Filter low-quality and false positive vulnerability findings from scanners and agent output.

Official
Intermediate
EntroVyxEntroVyx
3

web2-recon

Automate subdomain enumeration, live host discovery, and directory fuzzing for web applications.

Community
Advanced
rafaelcallejarafaelcalleja
2

ffuf-web-fuzzing

Fuzz web resources to discover hidden directories, files, and subdomains.

Community
Advanced