Automate subdomain enumeration and active service discovery for web attack surfaces.
npx skills add https://github.com/pdparchitect/rook --skill web2-recon-pdparchitect
Please help me install this Agent Skill. Skill: web2-recon Source: https://github.com/pdparchitect/rook/tree/main/skills/web2-recon Command: npx skills add https://github.com/pdparchitect/rook --skill web2-recon-pdparchitect
This skill solves the problem of fragmented and manual asset discovery by providing a unified, automated pipeline that maps an organization's entire external attack surface from scratch.
Run the web2-recon skill by providing the target domain to initiate the full asset discovery and vulnerability triage pipeline.
High-intent search queries and answers about installing and using this skill.
Automated subdomain enumeration and live host identification are achieved by running a unified pipeline that maps an organization's external attack surface from scratch. It chains multi-source discovery tools to rapidly find live hosts and API endpoints.
Continuous monitoring for new subdomains is handled by the pipeline's automated alerting mechanism, which maintains situational awareness over a target's infrastructure by tracking new subdomain registrations and GitHub commits.
Automated vulnerability triage works by integrating scanning tools to identify common bug classes like SQLi, SSRF, and IDOR. It applies a scoring rubric to the findings to assist in prioritizing targets during security research.
Yes, you need specific command line tools installed. The pipeline orchestrates dependencies including subfinder, httpx, dnsx, nuclei, katana, ffuf, naabu, and jq to execute its subdomain enumeration, crawling, and scanning tasks.
Yes, automated reconnaissance is designed for bug hunting engagements requiring rapid URL crawling and directory fuzzing. It automates the end-to-end discovery of web-based attack surfaces and collects structured data.
When fingerprinting web stacks across many discovered hosts, limitations may arise from active scanning rate limits or unresponsive services. The pipeline relies on active service discovery, meaning firewalled or non-standard ports might be missed during enumeration.
elementalsoulsAutomates web asset discovery and surface mapping using standard recon tools.
pdparchitectExecute a bug bounty pipeline for reconnaissance, vulnerability research, and automated security testing.
Kisilev13Structure external red-team reconnaissance with a 5-stage OSINT pipeline.
Bsh13lderEnumerate subdomains, verify live hosts, collect URLs, and scan for vulnerabilities.
