How do I install the Awesome Offsec Advanced Recon skill?

Run npx skillmds@latest add netvar1337/awesome-offsec-advanced-recon in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Awesome Offsec Advanced Recon safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Awesome Offsec Advanced Recon?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Awesome Offsec Advanced Recon free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under GPLv3.

Who published Awesome Offsec Advanced Recon?

netvar1337 (@netvar1337) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Awesome Offsec Advanced Recon by netvar1337

Name: Awesome Offsec Advanced Recon
Author: netvar1337

File contents

Advanced Reconnaissance

Skill Overview

Prerequisites: DNS, HTTP, command-line tools
Goal: Discover maximum attack surface with minimal detection

Core Philosophy

Breadth → Depth → Exploitation Wide net → Focus → Attack

Key Principle: 80% of bugs come from assets others miss.

The 5-Layer Approach

Layer 1: Organization Intelligence (scope understanding)
Layer 2: Passive Subdomain Discovery (no target contact)
Layer 3: Active Discovery (DNS queries, brute-forcing)
Layer 4: Asset Enumeration (ports, services, tech stack)
Layer 5: Deep Content Discovery (endpoints, parameters)

Layer 1: Organization Intelligence

ASN & IP Range Discovery

Use whois and amass intel to find ASNs and IP ranges.
Reference: Use results to feed into active_discovery workflows.

Layer 2: Passive Subdomain Discovery

Certificate Transparency & DNS Aggregators

Tools: subfinder, amass, crt.sh.
Goal: Build a seed list for active resolution.

Search Engine Dorking

Google/GitHub dorks to find shadow IT and dev environments.

Layer 3: Active Subdomain Discovery

DNS Brute-Forcing

Tools: puredns, shuffledns.
Strategy: Use massive wordlists (Jhaddix/SecLists) + Permutations (altdns).

Layer 4: Asset Discovery

Port Scanning & Service Enumeration

Tools: naabu, nmap.
Output: live.txt (Httpx results)
Integration: Feed live web services to web_application_security skills.

Technology Detection

Tools: nuclei -t technologies, whatweb.
Identify WAFs early (refer to waf_bypass skill if blocked).

Layer 5: Deep Content Discovery

Crawling & JavaScript Analysis

Tools: katana, hakrawler.
Action: Extract API endpoints from JS files (refer to javascript_analysis skill for deobfuscation).

Cloud Asset Discovery

AWS/Azure/GCP: Bucket enumeration and cloud-specific pattern scanning.

Automation

Build pipelines using tmux or axiom for distributed scanning.
Continuous Monitoring: Alert on new subdomains (Cron + Subfinder).

Data Organization

Maintain a standardized directory structure (recon/target/subdomains, recon/target/web, etc.) as defined in the overarching methodology.

---name: awesome-offsec-advanced-recondescription: Elite methodology for discovering maximum attack surface with minimal detection (5-Layer Approach).license: GPLv3---# Advanced Reconnaissance## Skill Overview**Prerequisites**: DNS, HTTP, command-line tools **Goal**: Discover maximum attack surface with minimal detection---## Core PhilosophyBreadth → Depth → ExploitationWide net → Focus → Attack**Key Principle**: 80% of bugs come from assets others miss.---## The 5-Layer Approach1. **Layer 1: Organization Intelligence** (scope understanding)2. **Layer 2: Passive Subdomain Discovery** (no target contact)3. **Layer 3: Active Discovery** (DNS queries, brute-forcing)4. **Layer 4: Asset Enumeration** (ports, services, tech stack)5. **Layer 5: Deep Content Discovery** (endpoints, parameters)---## Layer 1: Organization Intelligence### ASN & IP Range Discovery- Use `whois` and `amass intel` to find ASNs and IP ranges.- **Reference**: Use results to feed into `active_discovery` workflows.---## Layer 2: Passive Subdomain Discovery### Certificate Transparency & DNS Aggregators- Tools: `subfinder`, `amass`, `crt.sh`.- **Goal**: Build a seed list for active resolution.### Search Engine Dorking- Google/GitHub dorks to find shadow IT and dev environments.---## Layer 3: Active Subdomain Discovery### DNS Brute-Forcing- Tools: `puredns`, `shuffledns`.- **Strategy**: Use massive wordlists (Jhaddix/SecLists) + Permutations (`altdns`).---## Layer 4: Asset Discovery### Port Scanning & Service Enumeration- Tools: `naabu`, `nmap`.- **Output**: `live.txt` (Httpx results)- **Integration**: Feed live web services to `web_application_security` skills.### Technology Detection- Tools: `nuclei -t technologies`, `whatweb`.- Identify WAFs early (refer to `waf_bypass` skill if blocked).---## Layer 5: Deep Content Discovery### Crawling & JavaScript Analysis- Tools: `katana`, `hakrawler`.- **Action**: Extract API endpoints from JS files (refer to `javascript_analysis` skill for deobfuscation).---## Cloud Asset Discovery- **AWS/Azure/GCP**: Bucket enumeration and cloud-specific pattern scanning.---## Automation- Build pipelines using `tmux` or `axiom` for distributed scanning.- **Continuous Monitoring**: Alert on new subdomains (Cron + Subfinder).---## Data OrganizationMaintain a standardized directory structure (`recon/target/subdomains`, `recon/target/web`, etc.) as defined in the overarching methodology.

Frequently asked questions

Awesome Offsec Advanced Recon