skills.rest
Mikacr1138
Mikacr1138COMMUNITY
Explore all skills by this author →
GitHub

web2-recon

Automate web2 reconnaissance from subdomain enumeration to JS analysis.

2|1|Updated Mar 20, 2026
Search Tags:#subdomain-enumeration#recon#live-host-discovery#url-crawling#js-analysis#web2
One-click install
npx skills add https://github.com/Mikacr1138/claude-bug-bounty --skill web2-recon-mikacr1138
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: web2-recon
Source: https://github.com/Mikacr1138/claude-bug-bounty/tree/main/skills/web2-recon
Command: npx skills add https://github.com/Mikacr1138/claude-bug-bounty --skill web2-recon-mikacr1138

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Web2 recon pipeline automates surface mapping for web targets by combining subdomain enumeration, live-host discovery, URL collection, JS analysis, and continuous monitoring to reduce manual effort and speed up vulnerability hunting.

Core Features & Use Cases

  • Subdomain enumeration using subfinder, Chaos API, and assetfinder to build a comprehensive domain set.
  • Live-host discovery with dnsx and httpx to validate reachable targets.
  • URL crawling with katana, waybackurls, and gau to assemble an actionable URL map.
  • Directory fuzzing with ffuf to uncover hidden endpoints.
  • JS analysis using LinkFinder and SecretFinder to surface hidden endpoints and secrets.
  • Continuous monitoring: new subdomain alerts, JS change detection, and GitHub commit watch for ongoing surface awareness. Use Case: When starting reconnaissance on a new web-target, run the pipeline to generate a prioritized URL list for hunting.

Quick Start

Run the web2-recon pipeline against a target domain to generate a prioritized URL map for initial hunting.

Frequently Asked Questions about web2-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate subdomain enumeration and live-host discovery for a new web target?▼

Automate web2 recon by orchestrating subdomain enumeration with subfinder, Chaos API, and assetfinder, then validate live-host discovery using dnsx and httpx to map reachable targets.

What is the best way to crawl URLs and fuzz hidden directories during web2 recon?▼

The best way to crawl URLs is using katana, waybackurls, and gau to build a URL map, followed by directory fuzzing with ffuf to uncover hidden endpoints on the target.

How does JavaScript analysis help surface hidden endpoints and secrets in attack surface mapping?▼

JavaScript analysis surfaces hidden endpoints and secrets by parsing JS files using LinkFinder and SecretFinder, extracting actionable paths and sensitive data from the target's scripts.

Can I use this web2 recon pipeline for continuous attack surface monitoring?▼

Yes, you can use the pipeline for continuous attack surface monitoring by setting up new subdomain alerts, detecting JS changes, and watching GitHub commits for ongoing awareness.

Do I need any external dependencies to run subdomain enumeration and JS analysis?▼

No external skill dependencies are required to run the pipeline, but the underlying tools like subfinder, httpx, katana, ffuf, and LinkFinder must be available in your environment.

Related Skills

Explore More Software Engineering Skills→
elementalsoulselementalsouls
3.3k

web2-recon

Automates web asset discovery and surface mapping using standard recon tools.

Community
Advanced
jcastillotxjcastillotx

Metasploit Framework

Automate authorized Metasploit penetration testing with MSFConsole workflows and msfvenom payload generation.

Community
Advanced
L3DigitalNetL3DigitalNet
6

nmap

Scan networks for hosts, ports, services, and operating systems using nmap.

Official
Intermediate
jaskaranhundaljaskaranhundal
3

attack-surface-management

Discover, inventory, and risk-score internet-facing assets continuously.

Community
Advanced