skills.rest
inventashif
inventashifCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

web2-recon

Automates subdomain enumeration, live host discovery, URL crawling, and attack surface triage for web targets.

Updated Sep 6, 2026
Search Tags:#web security#subdomain enumeration#attack surface#osint#nuclei#bug bounty#recon
One-click install
npx skills add https://github.com/inventashif/helpful-code-sidekick --skill web2-recon-inventashif
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: web2-recon
Source: https://github.com/inventashif/helpful-code-sidekick/tree/main/scripts/hackerai/skills/bughunter/web2-recon
Command: npx skills add https://github.com/inventashif/helpful-code-sidekick --skill web2-recon-inventashif

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Starting recon on a new web target involves dozens of disconnected tools and manual steps, making it easy to miss subdomains, API endpoints, or exposed secrets before other hunters find them. ## Core Features & Use Cases - Full Recon Pipeline: Chains subfinder, Chaos API, assetfinder, dnsx, httpx, katana, waybackurls, gau, and nuclei into a single repeatable workflow from domain to prioritized URL list. - Attack Surface Triage: Classifies discovered URLs with gf patterns (XSS, SSRF, IDOR, SQLi, LFI, RCE) and greps for interesting parameters, API endpoints, and admin paths. - JS Analysis & Secret Scanning: Runs LinkFinder and SecretFinder against JavaScript bundles to extract hidden endpoints, API keys, and tokens. - Continuous Monitoring: Provides cron-ready scripts for new subdomain alerts and GitHub commit watching so you learn about changes before other hunters. - Use Case: Given a new bug bounty target domain, run the 30-minute recon protocol to produce subdomains.txt, live-hosts.txt, urls.txt, and a nuclei findings file, then score the target with the go/no-go rubric before committing time. ## Quick Start Ask the assistant to run the web2 recon pipeline against target.com and produce a prioritized list of live hosts and interesting endpoints.

Frequently Asked Questions about web2-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enumerate subdomains for a bug bounty target?▼

Combine crt.sh certificate transparency queries, the Chaos API, subfinder, and assetfinder, then deduplicate results with anew. Resolve candidates with dnsx and probe live hosts with httpx to get status codes, titles, and tech fingerprints.

What tools find hidden API endpoints in JavaScript files?▼

LinkFinder extracts endpoint paths from JS bundles, while SecretFinder scans the same files for API keys and tokens. Run both against every .js URL discovered during crawling with katana, waybackurls, or gau.

How do I find exposed Swagger or OpenAPI specs on a target?▼

Fuzz a wordlist of default spec paths such as /swagger/v1/swagger.json, /openapi.json, /v3/api-docs, and /api-docs using ffuf or httpx. A 404 on /swagger alone does not mean no spec exists, so test the full path list.

Why do dnsx and httpx crash with SIGSEGV on macOS arm64?▼

The ProjectDiscovery Go binaries can segfault due to a cgo and system-resolver interaction on macOS arm64, regardless of install method. Use the documented dig and curl fallback loops, which handle under 100 hosts in about 14 seconds.

When should I skip a bug bounty target after recon?▼

Skip when the target scores below 4 on the go/no-go rubric, when all subdomains return static marketing pages, when no API endpoints or JS bundles appear, or when nuclei returns zero medium or high findings within the first five minutes.

Related Skills

Explore More Software Engineering Skills→
VenTheZoneVenTheZone
1

hack-scope

Analyze VDP documentation to define security assessment scope boundaries.

Community
Intermediate
Kisilev13Kisilev13

security-arsenal

Provide security payloads for XSS, SSRF, SQLi, and other web vulnerabilities.

Community
Advanced
xalgordxalgord
846

subdomain-enumeration

Enumerate subdomains and identify live hosts and takeover candidates.

Community
Advanced
ArianHobson333ArianHobson333
7

reconnaissance

Identify subdomains, ports, endpoints, APIs, and attack surfaces.

Community
Advanced