How do I install the Recon Content Discovery skill?

Run npx skillmds@latest add noorqureshi/recon-content-discovery in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Recon Content Discovery safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Recon Content Discovery?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Recon Content Discovery free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Recon Content Discovery?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Recon Content Discovery by noorqureshi

Name: Recon Content Discovery
Author: NoorQureshi

Recon Content Discovery

Discover hidden paths, endpoints, params, and JS-exposed routes on a web target. Load after a live host is found, on "dirbust/content discovery/fuzzing", or when mapping an app's real surface. Signals: a single web host to deep-map, SPA with API calls, /api, JS bundles.

NoorQureshi Updated Sep 17, 2026

File contents

Content & endpoint discovery

When it applies

You have a live host and need its real surface: hidden dirs, backups, admin panels, API routes, and parameters — the inputs every other skill tests.

Why it works

Apps expose far more than the UI links to. Historical URLs, JS bundles, and predictable paths reveal endpoints (and params) that were never meant to be public or were left from old versions.

Method

Passive URL mining first: gau target.com + waybackurls pull historical URLs (old params, deprecated endpoints) with zero requests to the target.
Crawl, incl. JS: katana -u https://target -jc -kf all or gospider to extract links and endpoints embedded in JavaScript (SPAs hide the API here).
Directory/file brute: feroxbuster -u https://target -w raft-medium-directories.txt -x php,txt,bak,zip,json — recursive; add extensions matching the stack.
Parameter discovery: arjun -u https://target/endpoint finds hidden GET/POST params that feed injection tests (XSS/SQLi/IDOR).
Rank findings: admin/upload/import/debug/graphql/swagger routes and anything with params go to the front of the hunting queue.

Gotchas

Auto-calibrate against soft-404s (ffuf -ac, ferox filters) or you'll drown in false 200s.
Respect rate limits/program rules — throttle (-t, --rate-limit) on live targets.
Pull params from JS and wayback; each finds ones the other misses.

Verify success

A prioritized list of reachable endpoints + parameters, feeding web-*/api-* hunting.

References

ProjectDiscovery katana; feroxbuster/ffuf docs; s0md3v Arjun; TomNomNom gau/waybackurls.

---name: recon-content-discoverydescription: Discover hidden paths, endpoints, params, and JS-exposed routes on a web target. Load after a live host is found, on "dirbust/content discovery/fuzzing", or when mapping an app's real surface. Signals: a single web host to deep-map, SPA with API calls, /api, JS bundles.---# Content & endpoint discovery## When it appliesYou have a live host and need its *real* surface: hidden dirs, backups, admin panels, APIroutes, and parameters — the inputs every other skill tests.## Why it worksApps expose far more than the UI links to. Historical URLs, JS bundles, and predictable pathsreveal endpoints (and params) that were never meant to be public or were left from old versions.## Method1. **Passive URL mining first**: `gau target.com` + `waybackurls` pull historical URLs (old params, deprecated endpoints) with zero requests to the target.2. **Crawl, incl. JS**: `katana -u https://target -jc -kf all` or `gospider` to extract links and endpoints embedded in JavaScript (SPAs hide the API here).3. **Directory/file brute**: `feroxbuster -u https://target -w raft-medium-directories.txt -x php,txt,bak,zip,json` — recursive; add extensions matching the stack.4. **Parameter discovery**: `arjun -u https://target/endpoint` finds hidden GET/POST params that feed injection tests (XSS/SQLi/IDOR).5. **Rank findings**: admin/upload/import/debug/graphql/swagger routes and anything with params go to the front of the hunting queue.## Gotchas- Auto-calibrate against soft-404s (`ffuf -ac`, ferox filters) or you'll drown in false 200s.- Respect rate limits/program rules — throttle (`-t`, `--rate-limit`) on live targets.- Pull params from JS *and* wayback; each finds ones the other misses.## Verify successA prioritized list of reachable endpoints + parameters, feeding `web-*`/`api-*` hunting.## ReferencesProjectDiscovery katana; feroxbuster/ffuf docs; s0md3v Arjun; TomNomNom gau/waybackurls.

Frequently asked questions