web2-recon

Automate web2 reconnaissance with subdomain enumeration, live host discovery, and URL crawling.

Updated Jun 23, 2024

Search Tags:#subdomain-enumeration #continuous-monitoring #live-host-discovery #url-crawling #js-analysis #web2-recon

Ready to run

npx skills add https://github.com/n4igme/randscript --skill web2-recon-n4igme

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: web2-recon
Source: https://github.com/n4igme/randscript/tree/main/llm/skills/claude-hunter/skills/web2-recon
Command: npx skills add https://github.com/n4igme/randscript --skill web2-recon-n4igme

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Web2 reconnaissance often requires stitching together multiple tools to identify subdomains, live hosts, URLs, and JavaScript surface areas. This skill automates the process to map a target's attack surface and prioritize findings for security testing.

Core Features & Use Cases

Automated subdomain enumeration using subfinder, Chaos API, and assetfinder; live host discovery with dnsx and httpx; URL crawling with katana, waybackurls, and gau; directory fuzzing with ffuf; JavaScript analysis with LinkFinder and SecretFinder; and continuous monitoring for new subdomains, JS changes, and GitHub commits.
Use cases include starting recon on a new web2 target, asset discovery, subdomain enumeration, and attack-surface mapping for ongoing security programs.

Quick Start

Provide an initial recon run for a target by launching the full web2-recon pipeline to generate a prioritized URL list for testing.

Frequently Asked Questions about web2-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate web2 reconnaissance and attack surface mapping?▼

Automated web2 reconnaissance orchestrates subdomain enumeration, live host discovery, URL crawling, and JS analysis to map a target's attack surface. This skill coordinates tools like subfinder, httpx, and katana to prioritize findings for security testing.

What is the best way to enumerate subdomains and discover live hosts?▼

Subdomain enumeration and live host discovery are automated using subfinder, Chaos API, assetfinder, dnsx, and httpx. This approach maps valid targets by resolving DNS and verifying HTTP responsiveness across diverse environments.

Can I use this skill for continuous monitoring of subdomains and JavaScript changes?▼

Yes, continuous monitoring tracks new subdomains, JavaScript changes, and GitHub commits. This ensures ongoing asset discovery and attack-surface mapping for security programs rather than just providing a one-time recon snapshot.

Do I need external tools like katana and ffuf to crawl URLs and fuzz directories?▼

Yes, URL crawling with katana, waybackurls, and gau, plus directory fuzzing with ffuf, require these external tools to be available. The skill orchestrates them to extract URLs and identify hidden paths.

How does JavaScript analysis find secrets and endpoints during recon?▼

JavaScript analysis uses LinkFinder and SecretFinder to parse JS files for hidden endpoints and secrets. This maps the application's true attack surface by revealing API routes and credentials embedded in client-side code.

What are the limitations of automating web2 reconnaissance with external tools?▼

Automation depends entirely on external tools like subfinder, httpx, and ffuf being installed and configured. Without these dependencies available in the environment, the reconnaissance pipeline cannot execute.