web2-recon

Automate web2 reconnaissance with subdomain enumeration, live host discovery, and vulnerability scanning.

Updated Jun 21, 2026

Search Tags:#cybersecurity #subdomain enumeration #vulnerability scanning #continuous monitoring #web reconnaissance

Ready to run

npx skills add https://github.com/infantesromeroadrian/arca-agent --skill web2-recon-infantesromeroadrian

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: web2-recon
Source: https://github.com/infantesromeroadrian/arca-agent/tree/main/template/skills/web2-recon
Command: npx skills add https://github.com/infantesromeroadrian/arca-agent --skill web2-recon-infantesromeroadrian

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill streamlines the reconnaissance phase for web2 applications, automating a range of discovery tasks and providing a framework for further analysis.

Core Features & Use Cases

Subdomain Enumeration: Utilizes multiple sources for comprehensive subdomain identification.
Live Host Discovery: Identifies active hosts from the discovered subdomains.
URL Crawl & Analysis: Systematically crawls web pages and analyzes for vulnerabilities and interesting endpoints.
Continuous Monitoring: Sets up scripts for daily alerts of new subdomains and GitHub commits.
JS Analysis: Scans JavaScript for potential secrets and hidden endpoints.
Attack Surface Triage: Provides a scoring system to prioritize targets.
Tech Stack Detection: Identifies the web server and framework to help in bug hunting.
30-Minute Recon Protocol: A structured approach for quick reconnaissance.

Quick Start

Run the standard recon pipeline for 'target.com' by executing the following commands:

uvx web2-recon target.com

Frequently Asked Questions about web2-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate subdomain enumeration and vulnerability scanning for a web target?▼

Automated subdomain enumeration and vulnerability scanning is performed by combining subfinder, chaos API, and nuclei to systematically discover live hosts and analyze web pages. This Skill provides a structured pipeline to execute these reconnaissance tasks automatically.

What is the best way to continuously monitor new subdomains for a target domain?▼

Continuous monitoring of new subdomains is achieved by setting up dedicated scripts that provide daily alerts for newly discovered subdomains and recent GitHub commits. This ensures ongoing visibility into changes in the target's attack surface.

How can I scan JavaScript files for hidden endpoints and secrets during web reconnaissance?▼

Scanning JavaScript files for hidden endpoints and secrets is handled during the URL crawl and analysis phase. The reconnaissance pipeline systematically identifies and analyzes JavaScript resources to uncover potential vulnerabilities and exposed credentials.

Does this web reconnaissance pipeline require manual tool configuration to identify the tech stack?▼

Identifying the web server and framework does not require manual configuration, as the pipeline automatically detects the tech stack during the reconnaissance process. This helps prioritize targets and streamline bug hunting efforts.

Can I execute a quick reconnaissance protocol for a target domain within a short timeframe?▼

A quick reconnaissance protocol is supported through a structured 30-minute approach designed for rapid target assessment. This allows you to quickly triage the attack surface and prioritize targets based on a provided scoring system.

How do I discover live hosts from a large list of enumerated subdomains?▼

Discovering live hosts from enumerated subdomains is accomplished using the built-in live host discovery feature of the pipeline. It filters active targets from the comprehensive subdomain list generated by multiple identification sources.