skills.rest
guib1
guib1COMMUNITY
Explore all skills by this author →
GitHub

web2-recon

Automate web2 reconnaissance by chaining subdomain enumeration, live-host discovery, and URL crawling.

1|1|Updated Mar 24, 2026
Search Tags:#monitoring#recon#asset-discovery#subdomain#js-analysis#web2
One-click install
npx skills add https://github.com/guib1/red-team-docker --skill web2-recon-guib1
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: web2-recon
Source: https://github.com/guib1/red-team-docker/tree/main/pentest-lab/.agents/skills/bug-bounty/skills/web2-recon
Command: npx skills add https://github.com/guib1/red-team-docker --skill web2-recon-guib1

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Web2 reconnaissance often requires coordinating multiple tools to enumerate subdomains, validate live hosts, crawl URLs, and extract JS references. This skill provides an integrated pipeline to automate asset discovery and surface mapping, reducing manual digging and speeding up initial reconnaissance.

Core Features & Use Cases

  • Subdomain enumeration using subfinder, Chaos API, and assetfinder.
  • Live host discovery with dnsx and httpx, plus historical URL aggregation via waybackurls and gau.
  • JS analysis and asset extraction with LinkFinder and SecretFinder; continuous monitoring for new subdomains, JS changes, and GitHub commits.
  • Use Case: Initiate recon on a new web target to rapidly produce a prioritized URL list and an asset map for hunting.

Quick Start

Run the web2-recon pipeline to enumerate subdomains, discover live hosts, crawl historical URLs, and identify JS assets for asset mapping.

Frequently Asked Questions about web2-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate web2 reconnaissance for subdomain enumeration and asset discovery?▼

Automate web2 reconnaissance by chaining subdomain enumeration, live-host discovery, and URL crawling to map the attack surface. This pipeline integrates subfinder, Chaos API, and assetfinder to rapidly produce a prioritized URL list and asset map.

What is the best way to discover live web hosts after finding subdomains?▼

Discover live web hosts by validating enumerated subdomains using dnsx and httpx. This ensures your web2 attack surface mapping only contains responsive targets for subsequent URL crawling and JS analysis.

Can I extract JavaScript references and secrets during web2 asset discovery?▼

Extract JavaScript references and secrets during web2 asset discovery using LinkFinder and SecretFinder. This JS analysis identifies hidden assets and sensitive data within your crawled URLs and historical archives.

How do I aggregate historical URLs for comprehensive attack surface mapping?▼

Aggregate historical URLs for attack surface mapping using waybackurls and gau. These tools collect archived web paths, complementing live host discovery to provide end-to-end coverage for your web2 targets.

Does web2 reconnaissance support continuous monitoring for new subdomains and JS changes?▼

Web2 reconnaissance supports continuous monitoring to detect new subdomains, JS changes, and GitHub commits. This ongoing surveillance alerts you to attack surface modifications on existing web targets.

What tools do I need to run an automated subdomain enumeration and crawling pipeline?▼

Running an automated subdomain enumeration and crawling pipeline requires integrating tools like subfinder, dnsx, httpx, katana, and ffuf. These dependencies provide end-to-end coverage from asset discovery to URL extraction.

Related Skills

Explore More Software Engineering Skills→
bpnrockstarbpnrockstar

web2-recon

Automate web2 reconnaissance with subdomain discovery, live host enumeration, URL crawling, and JavaScript bundle analysis.

Community
Advanced
uphiagouphiago
1.1k

cors-chain-automation

Probe API endpoints for exploitable CORS misconfigurations and generate PoC files.

Community
Intermediate
elementalsoulselementalsouls
3.3k

web2-recon

Automates web asset discovery and surface mapping using standard recon tools.

Community
Advanced
EarthmanWebEarthmanWeb
2

stream-chain

Execute sequential multi-agent workflows via custom prompt chains and predefined pipelines.

Community
Advanced