# Reconnaissance

> Domain assessment and web application mapping - subdomain discovery, port scanning, endpoint enumeration, API discovery, and attack surface analysis.

- Skill: `bertbertov/reconnaissance` (Agent Skill)
- Install (CLI): `npx skillmds@latest add bertbertov/reconnaissance`
- Raw SKILL.md: https://api.skillmd.com/api/skills/bertbertov/reconnaissance/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- Author: bertbertov (https://skillmd.com/u/bertbertov)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/bertbertov/reconnaissance

---


# Reconnaissance

Domain and web application reconnaissance. Discovers subdomains, open ports, endpoints, APIs, and JavaScript routes to build attack surface inventory.

## Phases

### Domain Assessment
1. **Subdomain Discovery** - Passive DNS, certificate transparency, DNS brute-forcing, zone transfers
2. **Port Scanning** - nmap/masscan (top 1000/10000/all), service detection, OS fingerprinting
3. **Service Enumeration** - Version detection, banner grabbing, protocol-specific enumeration

### Web Application Mapping
0. **Software Inventory** - Dependencies, frameworks, SBOM generation
1. **Active Scanning** - ffuf, gobuster, nikto, ZAP spider for directories/files
2. **API Discovery** - REST, GraphQL, SOAP, WebSocket, Swagger/OpenAPI docs
3. **JavaScript & SPA** - Client-side routes, dynamic scripts, browser storage
4. **Surface Analysis** - Categorize attack surfaces, prioritize by risk

## Output

```
inventory/  - JSON: subdomains, ports, endpoints, APIs, SBOM
analysis/   - MD: attack-surface, testing-checklist
raw/        - Tool outputs (nmap, ffuf, ZAP, subfinder)
```

## Tools

subfinder, amass, nmap, masscan, ffuf, gobuster, nikto, ZAP, Playwright MCP

## Related Skills

- `/osint` - Run alongside reconnaissance for repository enumeration, secret scanning, and git history analysis

## Rules

1. Passive discovery before active scanning
2. Always run `/osint` in parallel during Phase 2
3. Respect rate limits
4. Verify subdomains are live before port scanning
5. Save all raw tool outputs