# Web Recon

> Web content discovery and technology fingerprinting using gobuster, ffuf, feroxbuster, katana, httpx, and wafw00f

- Skill: `commonhuman-lab/web-recon` (Agent Skill)
- Install (CLI): `npx skillmds@latest add commonhuman-lab/web-recon`
- Raw SKILL.md: https://api.skillmd.com/api/skills/commonhuman-lab/web-recon/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- Author: commonhuman-lab (https://skillmd.com/u/commonhuman-lab)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/commonhuman-lab/web-recon

---


# web-recon

Web reconnaissance workflow for NyxStrike. Use this skill when a user wants to find hidden directories, endpoints, virtual hosts, crawl a web application, or detect the tech stack and WAF.

## Workflow

### 1. WAF detection (wafw00f)

Always check for a WAF first — it influences wordlist choice, rate, and evasion flags.

```
run_tool(tool="wafw00f", url="https://<target>")
```

If a WAF is detected, add evasion flags to subsequent tools (e.g. `--random-agent`, lower thread count).

### 2. HTTP probing and tech detection (httpx)

Fingerprint live hosts, status codes, titles, and tech stack before brute-forcing.

```
run_tool(tool="httpx", target="<target>", probe=true, tech_detect=true, title=true, status_code=true)
```

Use the tech stack findings to choose targeted wordlists:
- WordPress → use `wp-content`, `wp-admin` wordlists
- PHP → look for `.php` extensions
- Apache/Nginx → check for `.htaccess`, server-status

### 3. Directory and file discovery

**Fast sweep (ffuf)** — preferred for vhost and parameter fuzzing as well:

```
run_tool(tool="ffuf", url="https://<target>/FUZZ",
         wordlist="/usr/share/wordlists/dirb/common.txt",
         match_codes="200,204,301,302,307,401,403")
```

**Recursive discovery (feroxbuster)** — use when you need deep recursive scanning:

```
run_tool(tool="feroxbuster", url="https://<target>",
         wordlist="/usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt",
         threads=10)
```

**Extension-aware scan (gobuster)** — use when tech stack is known:

```
run_tool(tool="gobuster", url="https://<target>",
         mode="dir",
         wordlist="/usr/share/wordlists/dirb/common.txt",
         additional_args="-x php,html,txt,bak")
```

### 4. Web crawling (katana)

Crawl the application for JS-embedded endpoints, forms, and parameters:

```
run_tool(tool="katana", url="https://<target>")
```

Feed discovered endpoints into vulnerability scanning (see `web-vuln` skill).

### 5. Virtual host enumeration

Use ffuf in vhost mode to discover hidden vhosts:

```
run_tool(tool="ffuf", url="https://<target>",
         mode="vhost",
         wordlist="/usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt")
```

### 6. WordPress-specific scan (wpscan)

If WordPress is detected, run wpscan for plugin/theme vulns and user enumeration:

```
run_tool(tool="wpscan", url="https://<target>",
         additional_args="--enumerate u,p,t --plugins-detection aggressive")
```

## Wordlist selection guide

| Target type | Recommended wordlist |
|---|---|
| General dirs | `/usr/share/wordlists/dirb/common.txt` |
| Deep/thorough | `/usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt` |
| Files | `/usr/share/seclists/Discovery/Web-Content/raft-medium-files.txt` |
| API endpoints | `/usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt` |
| Backup files | `/usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt` |
| Vhosts | `/usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt` |

## NyxStrike Tool Reference

| Tool | Use case |
|---|---|
| `wafw00f` | WAF detection |
| `httpx` | HTTP probing, tech fingerprint |
| `ffuf` | Fast fuzzing (dirs, vhosts, params) |
| `feroxbuster` | Recursive content discovery |
| `gobuster` | Extension-aware dir/file brute-force |
| `katana` | Web crawling, JS endpoint extraction |
| `dirsearch` | Alternative web path scanner |
| `wpscan` | WordPress-specific enumeration |