Web Recon

web-recon

Web reconnaissance workflow for NyxStrike. Use this skill when a user wants to find hidden directories, endpoints, virtual hosts, crawl a web application, or detect the tech stack and WAF.

Workflow

1. WAF detection (wafw00f)

Always check for a WAF first — it influences wordlist choice, rate, and evasion flags.

run_tool(tool="wafw00f", url="https://<target>")

If a WAF is detected, add evasion flags to subsequent tools (e.g. --random-agent, lower thread count).

2. HTTP probing and tech detection (httpx)

Fingerprint live hosts, status codes, titles, and tech stack before brute-forcing.

run_tool(tool="httpx", target="<target>", probe=true, tech_detect=true, title=true, status_code=true)

Use the tech stack findings to choose targeted wordlists:

• WordPress → use wp-content, wp-admin wordlists
• PHP → look for .php extensions
• Apache/Nginx → check for .htaccess, server-status

3. Directory and file discovery

Fast sweep (ffuf) — preferred for vhost and parameter fuzzing as well:

run_tool(tool="ffuf", url="https://<target>/FUZZ",
         wordlist="/usr/share/wordlists/dirb/common.txt",
         match_codes="200,204,301,302,307,401,403")

Recursive discovery (feroxbuster) — use when you need deep recursive scanning:

run_tool(tool="feroxbuster", url="https://<target>",
         wordlist="/usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt",
         threads=10)

Extension-aware scan (gobuster) — use when tech stack is known:

run_tool(tool="gobuster", url="https://<target>",
         mode="dir",
         wordlist="/usr/share/wordlists/dirb/common.txt",
         additional_args="-x php,html,txt,bak")

4. Web crawling (katana)

Crawl the application for JS-embedded endpoints, forms, and parameters:

run_tool(tool="katana", url="https://<target>")

Feed discovered endpoints into vulnerability scanning (see web-vuln skill).

5. Virtual host enumeration

Use ffuf in vhost mode to discover hidden vhosts:

run_tool(tool="ffuf", url="https://<target>",
         mode="vhost",
         wordlist="/usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt")

6. WordPress-specific scan (wpscan)

If WordPress is detected, run wpscan for plugin/theme vulns and user enumeration:

run_tool(tool="wpscan", url="https://<target>",
         additional_args="--enumerate u,p,t --plugins-detection aggressive")

Wordlist selection guide

NyxStrike Tool Reference