skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

web2-recon

Automate subdomain enumeration, live host discovery, and directory fuzzing for web applications.

3|1|Updated Jul 2, 2026
Search Tags:#web security#subdomain enumeration#vulnerability scanning#attack surface#bug bounty#recon
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill web2-recon-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: web2-recon
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/web2-recon
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill web2-recon-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires subfinder, httpx, dnsx, nuclei, katana, waybackurls, gau, ffuf, anew, gf, naabu, trufflehog3, and includes references (resource) components.

What problem does it solve?

This skill solves the challenge of fragmented asset discovery by automating the entire pipeline from initial subdomain enumeration to prioritized vulnerability triage, ensuring no attack surface is overlooked.

Core Features & Use Cases

  • Full-Stack Recon: Automates subdomain enumeration, live host discovery, URL crawling, and directory fuzzing using industry-standard tools.
  • Intelligent Triage: Scores targets based on bounty potential and technical complexity, allowing hunters to focus on high-impact assets.
  • Continuous Monitoring: Provides automated alerts for new subdomains and GitHub commits to maintain an edge over other hunters.

Quick Start

Use the web2-recon skill to perform a full asset discovery and vulnerability scan on target.com.

Frequently Asked Questions about web2-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate subdomain enumeration and vulnerability scanning for bug bounty targets?▼

Automating subdomain enumeration and vulnerability scanning requires chaining tools like subfinder, httpx, and nuclei. This skill orchestrates that end-to-end pipeline, mapping the attack surface and identifying high-value targets through automated scoring.

What is the best way to map a web application's attack surface continuously?▼

Mapping a web application attack surface continuously involves automated alerts for new subdomains and code commits. This skill provides continuous monitoring alongside live host discovery and directory fuzzing to maintain an edge.

Do I need to install subfinder, httpx, and nuclei before running automated recon?▼

Yes, you need a configured environment with tools like subfinder, httpx, nuclei, ffuf, and katana pre-installed. The skill orchestrates these dependencies to execute the full discovery workflow and perform vulnerability triage.

Can I triage discovered web assets based on bug bounty potential?▼

Yes, you can triage discovered web assets based on bug bounty potential. The skill applies intelligent scoring to evaluate targets based on bounty potential and technical complexity, helping focus on high-impact assets.

How does directory fuzzing fit into a full-stack web reconnaissance pipeline?▼

Directory fuzzing fits into full-stack web reconnaissance by discovering hidden paths after live host discovery. Using tools like ffuf, the skill automates URL crawling and fuzzing to ensure no attack surface is overlooked.

Related Skills

Explore More Software Engineering Skills→
elementalsoulselementalsouls
3.3k

web2-recon

Automates web asset discovery and surface mapping using standard recon tools.

Community
Advanced
ajtazerajtazer

report-writing

Generates standardized vulnerability reports with CVSS guidance for bug bounty platforms.

Community
Advanced
mlvpatelmlvpatel
1

ghost-recon

Automate web2 reconnaissance with subdomain enumeration, host discovery, URL crawling, directory fuzzing, and JavaScript analysis.

Community
Advanced
uphiagouphiago
1.1k

web2-recon

Automate web2 attack surface mapping with subdomain enumeration, URL crawling, and JavaScript analysis.

Community
Advanced