Reconnaissance
Domain and web application reconnaissance. Discovers subdomains, open ports, endpoints, APIs, and JavaScript routes to build attack surface inventory.
Phases
Domain Assessment
- Subdomain Discovery - Passive DNS, certificate transparency, DNS brute-forcing, zone transfers
- Port Scanning - nmap/masscan (top 1000/10000/all), service detection, OS fingerprinting
- Service Enumeration - Version detection, banner grabbing, protocol-specific enumeration
Web Application Mapping
- Software Inventory - Dependencies, frameworks, SBOM generation
- Active Scanning - ffuf, gobuster, nikto, ZAP spider for directories/files
- API Discovery - REST, GraphQL, SOAP, WebSocket, Swagger/OpenAPI docs
- JavaScript & SPA - Client-side routes, dynamic scripts, browser storage
- Surface Analysis - Categorize attack surfaces, prioritize by risk
Output
inventory/ - JSON: subdomains, ports, endpoints, APIs, SBOM
analysis/ - MD: attack-surface, testing-checklist
raw/ - Tool outputs (nmap, ffuf, ZAP, subfinder)
Tools
subfinder, amass, nmap, masscan, ffuf, gobuster, nikto, ZAP, Playwright MCP
Related Skills
/osint - Run alongside reconnaissance for repository enumeration, secret scanning, and git history analysis
Rules
- Passive discovery before active scanning
- Always run
/osint in parallel during Phase 2
- Respect rate limits
- Verify subdomains are live before port scanning
- Save all raw tool outputs
1---2name: reconnaissance3description: Domain assessment and web application mapping - subdomain discovery, port scanning, endpoint enumeration, API discovery, and attack surface analysis.4---56# Reconnaissance78Domain and web application reconnaissance. Discovers subdomains, open ports, endpoints, APIs, and JavaScript routes to build attack surface inventory.910## Phases1112### Domain Assessment131. **Subdomain Discovery** - Passive DNS, certificate transparency, DNS brute-forcing, zone transfers142. **Port Scanning** - nmap/masscan (top 1000/10000/all), service detection, OS fingerprinting153. **Service Enumeration** - Version detection, banner grabbing, protocol-specific enumeration1617### Web Application Mapping180. **Software Inventory** - Dependencies, frameworks, SBOM generation191. **Active Scanning** - ffuf, gobuster, nikto, ZAP spider for directories/files202. **API Discovery** - REST, GraphQL, SOAP, WebSocket, Swagger/OpenAPI docs213. **JavaScript & SPA** - Client-side routes, dynamic scripts, browser storage224. **Surface Analysis** - Categorize attack surfaces, prioritize by risk2324## Output2526```27inventory/ - JSON: subdomains, ports, endpoints, APIs, SBOM28analysis/ - MD: attack-surface, testing-checklist29raw/ - Tool outputs (nmap, ffuf, ZAP, subfinder)30```3132## Tools3334subfinder, amass, nmap, masscan, ffuf, gobuster, nikto, ZAP, Playwright MCP3536## Related Skills3738- `/osint` - Run alongside reconnaissance for repository enumeration, secret scanning, and git history analysis3940## Rules41421. Passive discovery before active scanning432. Always run `/osint` in parallel during Phase 2443. Respect rate limits454. Verify subdomains are live before port scanning465. Save all raw tool outputs
bertbertov