skills.rest
Skobyn
SkobynCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

web2-recon

Automate web2 reconnaissance with subdomain enumeration, live host discovery, and URL crawling.

Updated Jun 24, 2026
Search Tags:#subdomain enumeration#JavaScript analysis#web2 recon#live host discovery#directory fuzzing#URL crawling
One-click install
npx skills add https://github.com/Skobyn/talon --skill web2-recon-skobyn
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: web2-recon
Source: https://github.com/Skobyn/talon/tree/main/skills/web2-recon
Command: npx skills add https://github.com/Skobyn/talon --skill web2-recon-skobyn

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires subfinder, httpx, dnsx, nuclei, katana, waybackurls, gau, dalfox, ffuf, anew, gf, interactsh-client, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill automates the process of recon for web2 targets, providing comprehensive subdomain enumeration, live host discovery, and URL crawling, among other features.

Core Features & Use Cases

  • Subdomain Enumeration: Automated discovery of subdomains to expand the attack surface.
  • Live Host Discovery: Identification of live hosts from subdomain lists.
  • URL Crawl: Gathering URLs for further analysis.
  • Directory Fuzzing: Fuzzing directories for hidden pages.
  • JS Analysis: Analysis of JavaScript files for potential vulnerabilities.
  • Use Case: For penetration testers and bug hunters who need to quickly identify and analyze a target's web application.

Quick Start

Run the web2-recon skill for a target, specifying the target domain name.

Frequently Asked Questions about web2-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate subdomain enumeration and live host discovery for web2 targets?▼

Automating subdomain enumeration and live host discovery involves chaining tools like subfinder to find subdomains and httpx to identify live hosts. This process expands the attack surface by systematically resolving and verifying target infrastructure.

What is the best way to gather URLs and fuzz directories for hidden pages during reconnaissance?▼

Gathering URLs and directory fuzzing uses tools like waybackurls and gau to pull historical URLs, while ffuf fuzzes directories for hidden pages. This combination exposes unlinked endpoints and sensitive files for further vulnerability analysis.

Can I analyze JavaScript files for vulnerabilities using nuclei and katana?▼

Yes, analyzing JavaScript files for vulnerabilities is supported using katana for crawling and nuclei for scanning. This detects potential security flaws within client-side code during penetration testing and bug hunting engagements.

Do I need to install subfinder, httpx, and dnsx separately to run web2 reconnaissance?▼

Yes, you need these dependencies installed in your environment to run web2 reconnaissance. The Skill orchestrates external tools like subfinder, httpx, and dnsx rather than replacing them, requiring them to be accessible.

Does this reconnaissance workflow support monitoring for infrastructure changes over time?▼

Monitoring for changes is supported using the anew tool to diff outputs. This tracks newly discovered subdomains, live hosts, or URLs across consecutive reconnaissance runs, highlighting expanding attack surfaces.

Related Skills

Explore More Software Engineering Skills→
zebbernzebbern
5

subdomain-enum

Enumerate subdomains with Subfinder, Amass, and Httpx pipelines.

Community
Advanced
xijunwwxijunww
1

known-product-exploit

Automate identification, exploitation, and post-exploitation of known product vulnerabilities with Nuclei.

Community
Advanced
enderphan94enderphan94
1

stress-scan

Orchestrate vulnerability agents to assess web surfaces and verify findings via HTTP and OOB channels.

Community
Advanced
bpnrockstarbpnrockstar

web2-recon

Automate web2 reconnaissance with subdomain discovery, live host enumeration, URL crawling, and JavaScript bundle analysis.

Community
Advanced