skills.rest
hataiit9x
hataiit9xCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

web2-recon

Enumerate subdomains, discover live hosts, crawl URLs, fuzz directories, and analyze JavaScript.

3|Updated Jul 6, 2026
Search Tags:#subdomain enumeration#JavaScript analysis#web2 recon#live host discovery#directory fuzzing#URL crawling
One-click install
npx skills add https://github.com/hataiit9x/Bbkit-AI --skill web2-recon-hataiit9x
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: web2-recon
Source: https://github.com/hataiit9x/Bbkit-AI/tree/main/ref/claude-bug-bounty/skills/web2-recon
Command: npx skills add https://github.com/hataiit9x/Bbkit-AI --skill web2-recon-hataiit9x

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires subfinder, httpx, dnsx, nuclei, katana, waybackurls, gau, ffuf, anew, gf, interactsh-client, trufflehog3, python3, git, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill addresses the challenge of conducting a thorough reconnaissance on web2 targets, covering subdomain enumeration, live host discovery, URL crawling, directory fuzzing, and JavaScript analysis.

Core Features & Use Cases

  • Subdomain Enumeration: Utilizes subfinder, Chaos API, and assetfinder for comprehensive subdomain discovery.
  • Live Host Discovery: Implements dnsx and httpx for identifying active hosts.
  • URL Crawling: Integrates katana, waybackurls, and gau for crawling and historical URL analysis.
  • Directory Fuzzing: Employs ffuf for directory discovery and IDOR fuzzing.
  • JS Analysis: Leverages LinkFinder and SecretFinder for JavaScript analysis.
  • Use Case: Ideal for security professionals starting a recon phase on a web2 application, needing to quickly gather a comprehensive understanding of the target's attack surface.

Quick Start

Run the recon pipeline for a target using the 'bb full target.com' command.

Frequently Asked Questions about web2-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate subdomain enumeration and live host discovery for web2 targets?▼

Automate subdomain enumeration and live host discovery by running the recon pipeline with the 'bb full target.com' command, which chains subfinder, dnsx, and httpx to identify active hosts.

What is the best way to crawl historical URLs and perform directory fuzzing on a web application?▼

The best way to crawl historical URLs and perform directory fuzzing is using an integrated pipeline that combines waybackurls and gau for URL crawling, alongside ffuf for directory discovery and IDOR fuzzing.

Do I need to manually install command-line tools like nuclei and katana before running web2 recon?▼

Yes, you need to manually install required dependencies, including subfinder, httpx, dnsx, nuclei, katana, waybackurls, gau, ffuf, and others, to ensure the recon pipeline executes correctly.

How does JavaScript analysis work during a web2 reconnaissance phase?▼

JavaScript analysis works by leveraging LinkFinder and SecretFinder tools to parse JS files, extracting hidden endpoints and sensitive secrets to expand the target's attack surface.

Can I use this pipeline for comprehensive bug bounty recon on large-scale applications?▼

Yes, you can use this pipeline for bug bounty recon, as it integrates Chaos API and assetfinder for comprehensive subdomain discovery, scaling effectively across large web2 applications.

Related Skills

Explore More Software Engineering Skills→
bpnrockstarbpnrockstar

web2-recon

Automate web2 reconnaissance with subdomain discovery, live host enumeration, URL crawling, and JavaScript bundle analysis.

Community
Advanced
manuelbrandner85manuelbrandner85

sarif-parsing

Parse SARIF 2.1.0 results and aggregate security findings by severity.

Community
Advanced
armanzeroeightarmanzeroeight
29

secrets-detector

Detect hardcoded secrets and API keys in source code repositories.

Community
Intermediate
Mikacr1138Mikacr1138
2

web2-recon

Automate web2 reconnaissance from subdomain enumeration to JS analysis.

Community
Intermediate