skills.rest
sseshachala
sseshachalaCOMMUNITY
Explore all skills by this author →
GitHub

web2-recon

Automate web2 asset discovery and attack-surface mapping with integrated recon tools.

Updated Jun 5, 2026
Search Tags:#monitoring#subdomain-enumeration#recon#live-host-discovery#url-crawling#js-analysis#web2
One-click install
npx skills add https://github.com/sseshachala/Claude-BugHunter-archive --skill web2-recon-sseshachala
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: web2-recon
Source: https://github.com/sseshachala/Claude-BugHunter-archive/tree/main/skills/web2-recon
Command: npx skills add https://github.com/sseshachala/Claude-BugHunter-archive --skill web2-recon-sseshachala

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Web2 reconnaissance often requires juggling multiple tools and sources to surface assets, subdomains, live hosts, and endpoints. This Skill provides a repeatable pipeline to automate asset discovery and attack-surface mapping for web-facing applications.

Core Features & Use Cases

  • Subdomain enumeration using subfinder, Chaos API, and assetfinder to build a comprehensive domain set.
  • Live host discovery with dnsx and httpx to validate reachability and host information.
  • URL crawling with katana, waybackurls, and gau to collect current and historical endpoints.
  • Directory fuzzing with ffuf to reveal hidden resources on discovered hosts.
  • JavaScript analysis with LinkFinder and SecretFinder to surface endpoints and secrets in bundles.
  • Continuous monitoring and alerts for new subdomains, JS changes, and GitHub commits to keep surface maps up to date.
  • Use cases: initial asset discovery, attack-surface mapping, and ongoing surface hygiene for engagements.

Quick Start

Run the web2 recon pipeline against a target to generate a prioritized URL list and surface assets for hunting.

Frequently Asked Questions about web2-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate web2 attack-surface mapping for a domain?▼

Web2 subdomain enumeration combines subfinder, Chaos API, and assetfinder to build a comprehensive domain set, then validates reachability using dnsx and httpx to identify live hosts for further probing.

What is the best way to find hidden endpoints in JavaScript bundles during recon?▼

Analyzing JavaScript bundles with LinkFinder and SecretFinder surfaces hidden endpoints and secrets, revealing actionable attack vectors that standard URL crawling with waybackurls or gau might miss.

Can I use waybackurls and gau for historical URL discovery alongside live host discovery?▼

Yes, waybackurls and gau collect historical endpoints while dnsx and httpx validate current live hosts, ensuring your recon captures both archived and active attack surfaces for the target domain.

Does this recon pipeline require ffuf for directory fuzzing on discovered hosts?▼

Yes, directory fuzzing with ffuf reveals hidden resources on discovered live hosts, expanding the mapped attack surface beyond initial subdomain enumeration and basic URL crawling results.

How do I monitor for new subdomains and JavaScript changes continuously?▼

Continuous monitoring tracks new subdomains, JS changes, and GitHub commits to keep your surface maps updated, enabling ongoing surface hygiene throughout the duration of your engagement.

Related Skills

Explore More Software Engineering Skills→
elementalsoulselementalsouls
3.3k

web2-recon

Automates web asset discovery and surface mapping using standard recon tools.

Community
Advanced
SkobynSkobyn

web2-recon

Automate web2 reconnaissance with subdomain enumeration, live host discovery, and URL crawling.

Community
Advanced
mlvpatelmlvpatel
1

ghost-recon

Automate web2 reconnaissance with subdomain enumeration, host discovery, URL crawling, directory fuzzing, and JavaScript analysis.

Community
Advanced
Mikacr1138Mikacr1138
2

web2-recon

Automate web2 reconnaissance from subdomain enumeration to JS analysis.

Community
Intermediate