skills.rest
uphiago
uphiagoCOMMUNITY
Explore all skills by this author →
Website𝕏@uphiagoGitHub

web2-recon

Automate web2 attack surface mapping with subdomain enumeration, URL crawling, and JavaScript analysis.

1.1k|191|Updated Jun 24, 2026
Search Tags:#penetration testing#subdomain enumeration#bug bounty#attack surface mapping#web2 recon#js analysis#directory fuzzing
One-click install
npx skills add https://github.com/uphiago/recon-skills --skill web2-recon-uphiago
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: web2-recon
Source: https://github.com/uphiago/recon-skills/tree/main/redteam/web2-recon
Command: npx skills add https://github.com/uphiago/recon-skills --skill web2-recon-uphiago

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill eliminates the hours of manual, error-prone work involved in web2 reconnaissance for penetration testing and bug bounty engagements, ensuring no attack surface is missed from incomplete subdomain enumeration, URL crawling, or JavaScript analysis.

Core Features & Use Cases

  • End-to-End Recon Pipeline: Automates passive subdomain enumeration (crt.sh, Chaos API, subfinder, assetfinder), live host detection, URL crawling (katana, waybackurls, gau), directory fuzzing, and JavaScript secret and endpoint extraction.
  • Attack Surface Triage: Uses pattern matching with gf and custom greps to quickly identify high-value targets like API endpoints, authentication paths, and file upload features.
  • Use Case: For a new bug bounty target, this Skill maps all assets, identifies 10+ high-priority endpoints, and flags potential CORS, IDOR, and XSS candidates in under 30 minutes, cutting initial recon time from hours to minutes.

Quick Start

Use the web2-recon skill to run a full asset discovery and attack surface mapping workflow on the target example.com, returning a prioritized list of subdomains, live hosts, URLs, and high-value endpoints for vulnerability hunting.

Frequently Asked Questions about web2-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate web2 attack surface mapping for bug bounty targets?▼

To automate web2 attack surface mapping, you can run an end-to-end pipeline that handles subdomain enumeration, live host detection, URL crawling, and JavaScript analysis, returning a prioritized list of assets and high-value endpoints for vulnerability hunting.

What is the best way to find hidden API endpoints in JavaScript bundles during recon?▼

Finding hidden API endpoints in JavaScript bundles is achieved by analyzing JS files to extract secrets and routes. This attack surface triage uses pattern matching to quickly identify high-value targets like authentication paths and API endpoints.

How do I prevent missed subdomains during passive reconnaissance?▼

To prevent missed subdomains during passive reconnaissance, an automated pipeline queries multiple sources like crt.sh, Chaos API, subfinder, and assetfinder, eliminating error-prone manual work and ensuring complete asset discovery.

Can I perform directory fuzzing and URL crawling in restricted worker environments?▼

Directory fuzzing and URL crawling in restricted worker environments are supported through configured fallback workflows. This ensures continuous monitoring and active recon toolchain operations succeed even when common tools fail.

How do I triage high-value targets like IDOR and XSS candidates after crawling URLs?▼

Triage high-value targets like IDOR and XSS candidates by applying pattern matching with gf and custom greps to crawled URLs. This identifies file upload features, authentication paths, and CORS candidates in minutes.

Related Skills

Explore More Software Engineering Skills→
jcastillotxjcastillotx

Metasploit Framework

Automate authorized Metasploit penetration testing with MSFConsole workflows and msfvenom payload generation.

Community
Advanced
mahamaneharouna9-cpumahamaneharouna9-cpu

web-security-expert

Identify and test web application vulnerabilities including OWASP Top 10 risks.

Community
Intermediate
zebbernzebbern
4.5k

Red Team Tools and Methodology

Automate red-team reconnaissance and vulnerability discovery workflows.

Community
Advanced
cybersecwomancybersecwoman
5

web2-recon

Automate web2 asset, subdomain, and endpoint discovery for security assessments.

Community
Advanced