web2-recon

Automates web asset discovery and surface mapping using standard recon tools.

3.3k|507|Updated May 5, 2026

Search Tags:#subdomain-enumeration #recon #asset-discovery #url-crawling #js-analysis #web2 #live-hosts

Ready to run

npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill web2-recon-elementalsouls

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: web2-recon
Source: https://github.com/elementalsouls/Claude-BugHunter/tree/main/skills/web2-recon
Command: npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill web2-recon-elementalsouls

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Suboptimal web2 reconnaissance often yields scattered assets, stale subdomains, and incomplete attack surface maps. This Skill automates web2 asset discovery and surface mapping to provide a prioritized URL list for hunting.

Core Features & Use Cases

Subdomain enumeration: using subfinder, Chaos API, and assetfinder to surface candidates.
Live-host discovery: dnsx/httpx to identify reachable hosts and basic tech stack indicators.
URL crawling: katana, waybackurls, gau to build a comprehensive URL set.
Directory fuzzing: ffuf to enumerate endpoints and potential V1 paths.
JS analysis: LinkFinder and SecretFinder to extract endpoints and secrets from bundles.
Continuous monitoring: alerts for new subdomains, JS changes, and GitHub commit activity to keep assets up to date.

Quick Start

Describe your target and testing objective in plain English to load the web2-recon pipeline automatically.

Frequently Asked Questions about web2-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate subdomain enumeration and live host discovery for web2 targets?▼

Automate web2 subdomain enumeration and live host discovery by chaining subfinder, Chaos API, and assetfinder for candidates, then resolving reachable hosts with dnsx and httpx.

What is the best way to extract endpoints and secrets from JavaScript bundles during recon?▼

Extract endpoints and secrets from JavaScript bundles during recon by running LinkFinder and SecretFinder against crawled URLs to parse hidden paths and sensitive data.

How do I build a comprehensive URL list for attack surface mapping using waybackurls and gau?▼

Build a comprehensive URL list for attack surface mapping by passing live hosts through katana, waybackurls, and gau to aggregate historical and actively crawled endpoints.

Do I need a Chaos API key to run this web2 reconnaissance pipeline?▼

Yes, a Chaos API key is required to run this web2 reconnaissance pipeline, alongside the standard tooling suite including subfinder, dnsx, httpx, katana, and ffuf.

Can I set up continuous monitoring for new subdomains and JavaScript changes?▼

Yes, continuous monitoring alerts for new subdomains, JavaScript changes, and GitHub commit activity to keep your web2 asset attack surface maps up to date automatically.

How do I fuzz directories and potential V1 paths after URL crawling?▼

Fuzz directories and potential V1 paths after URL crawling by feeding discovered live hosts into ffuf to enumerate hidden endpoints and expand the target surface.