Recon Automation

Recon Automation Skill

Overview

Systematic reconnaissance workflow for security assessments. Covers passive OSINT, active enumeration, secrets hunting, cloud asset discovery, and attack surface ranking. Integrates with industry-standard tools (subfinder, nmap, katana, trufflehog, cloud_enum, etc.) with graceful degradation when tools are missing. Results are persisted for reuse in subsequent hunting phases.

Money-Making Overview

Target buyer: CISOs, security teams, pentest firms, and DevOps leads who need to understand their external attack surface before attackers find the holes.

Service tiers:

First-dollar timeline: First Basic report sold within 1 week of offering it to existing security contacts or local businesses. Pro deals close in 2-3 weeks. Enterprise contracts require a delivered Basic or Pro report as proof of work.

Delivery: Email PDF report or private Notion page. Payment via invoice (NET-15) or Stripe link.

When to Use

Trigger phrases:

• "recon automation"

• "Pre-engagement reconnaissance for bug bounty or pentest"

• "Attack surface mapping for a target domain or organization"

• "Asset discovery: subdomains, live hosts, cloud buckets"

• Pre-engagement reconnaissance for bug bounty or pentest

• Attack surface mapping for a target domain or organization

• Asset discovery: subdomains, live hosts, cloud buckets

• Subdomain enumeration and validation

• Secrets leak detection across code repos, paste sites, and JS bundles

• Cloud bucket discovery (S3, Azure Blob, GCP Storage)

• Security audit preparation and scope inventory

• Re-running recon after discovering new root domains or acquisitions

The Process

1. Scope and authorize — confirm written authorization and define target boundaries
2. Reconnaissance — enumerate targets, services, and potential attack surfaces
3. Exploitation — attempt exploitation of identified vulnerabilities within scope
4. Post-exploitation — document access level, lateral movement, and data exposure
5. Report and remediate — compile findings with reproduction steps and fix recommendations

Step 1: Scope Validation

Verify the target is in-scope before any active or passive testing.

• Read program rules (bug bounty policy, ROE, pentest scope)
• Document authorization: who approved, what's in-scope, start/end dates
• Confirm target domains, IPs, CIDR ranges, and wildcards
• Identify explicit exclusions (e.g., *.cdn.example.com, production vs staging)
• Record scope in a local manifest file for reference during testing

Output: scope-manifest.json with authorized targets, exclusions, and authorization details.

Step 2: Passive Recon

OSINT gathering without sending traffic to the target.

• DNS records: A, AAAA, MX, NS, TXT, CNAME, SOA via dig or dnsx
• WHOIS: domain registration, registrar, name servers, creation/expiry dates
• Certificate Transparency: crt.sh, CertSpotter for subdomains from TLS certs
• Google Dorking: site:, inurl:, filetype:, intitle: for exposed pages and files
• Breach databases: HaveIBeenPwned, DeHashed for associated email/password leaks
• Code leaks: GitHub search (org:target), GitLab, Pastebin, S3 bucket listings
• Social media / metadata: employee names, tech stack hints from job postings, LinkedIn

Fallback: If no OSINT tools available, use curl against public APIs (crt.sh, WHOIS).

Step 3: Active Recon

Direct interaction with target infrastructure. Respect rate limits.

• Subdomain enumeration: subfinder -d target.com, amass enum -passive -d target.com, chaos -d target.com
• DNS resolution: dnsx -l subdomains.txt -resp to filter live resolvers
• Port scanning: nmap -sV -sC -T3 -iL live_hosts.txt (throttled), or masscan for fast sweep
• Service fingerprinting: httpx -l subdomains.txt -title -tech-detect -status-code -follow-redirects
• Technology detection: Wappalyzer CLI, httpx -tech-detect flag, WhatWeb

Fallback: Use curl -I for basic service fingerprinting if httpx unavailable. Use nc -zv for port checks if nmap unavailable.

Step 4: Web Crawling

Discover URLs, parameters, and endpoints from live web services.

• URL discovery: katana -u target.com -d 3 -jc (with JS parsing), gospider -s target.com
• Wayback Machine: waybackurls target.com for historical URLs and parameters
• Parameter extraction: arjun -u target.com for hidden parameters, x8 for parameter fuzzing
• JavaScript analysis: extract API endpoints, tokens, and secrets from JS bundles
• robots.txt / sitemap.xml: parse for hidden paths and disallowed directories
• Endpoint mapping: categorize URLs by type (API, admin, auth, upload, static)

Fallback: Use curl + manual regex for robots.txt/sitemap.xml parsing.

Step 5: Secrets Hunting

Detect credential leaks and exposed sensitive data.

• JS bundle analysis: search for API keys, tokens, auth headers in minified JS
• Exposed files: .env, .git/config, wp-config.php, .htaccess, config.json
• Git history: trufflehog git https://github.com/org/repo, gitleaks detect, noseyparker scan
• API key patterns: regex for AWS keys (AKIA...), Google API keys, Stripe keys, JWT secrets
• Hardcoded credentials: search for password=, secret=, token=, apikey= in source
• Paste sites: search GitHub gists, Pastebin, Ghostbin for target-related leaks

Fallback: Use grep -rE with common secret regex patterns across downloaded files.

Step 6: Cloud Recon

Discover cloud-hosted assets and potential misconfigurations.

• S3 bucket discovery: cloud_enum -k target, S3Scanner --list, brute-force bucket names
• Azure Blob: cloud_enum -k target with Azure module, check <account>.blob.core.windows.net
• GCP Storage: cloud_enum -k target with GCP module, check <project>.storage.googleapis.com
• CloudFlare bypass: find origin IPs via historical DNS (SecurityTrails), email headers, SSL certs
• CDN identification: identify CloudFlare, Fastly, Akamai, CloudFront from response headers
• Metadata endpoints: check 169.254.169.254 if SSRF is in-scope (only with authorization)

Fallback: Use curl to manually probe <bucket>.s3.amazonaws.com patterns.

Step 7: Surface Ranking

Prioritize discovered assets by potential value for security testing.

Output: surface-ranking.md with categorized, prioritized asset inventory.

External Tool Integration

Tools are optional. Each category has a fallback. Log missing tools and continue.

Output Format

Structured asset inventory saved as markdown and JSON:

recon-output/
  scope-manifest.json       # Authorized scope
  passive/
    dns-records.md
    subdomains-ct.md
    whois.md
    osint-notes.md
  active/
    live-hosts.txt
    port-scan.md
    technologies.md
  crawling/
    urls-all.txt
    endpoints.md
    parameters.txt
    js-secrets.md
  secrets/
    leaked-credentials.md
    exposed-files.md
    git-leaks.md
  cloud/
    buckets.md
    origin-ips.md
    cdn-info.md
  surface-ranking.md         # Prioritized attack surface
  recon-summary.md           # Executive summary

Session Persistence

• Save all recon output to recon-output/ directory per target
• Each step appends to its respective file; re-runs update, not overwrite
• Load previous results before re-running to avoid duplicate work
• Share output with hunting phase: reference URLs, secrets, and ranked targets

Incremental Recon

• Re-run specific steps as new information is discovered (e.g., new root domain from OSINT)
• New subdomains trigger re-run of Steps 3-4 (active + crawling)
• New live hosts trigger re-run of Steps 4-5 (crawling + secrets)
• Cloud findings trigger deeper cloud recon (Step 6)
• Track step completion timestamps in recon-summary.md

First Action in 60 Minutes

Run this script against any target domain to produce a client-ready attack surface report. It enumerates subdomains, live hosts, technologies, and exposed secrets with zero config beyond a domain name.

#!/usr/bin/env python3
"""attack-surface-report.py — One-shot recon-as-service deliverable.
Usage: python3 attack-surface-report.py target.com client-name
"""
import json, subprocess, sys, os, urllib.request
from datetime import datetime
from pathlib import Path

domain = sys.argv[1]
client = sys.argv[2] if len(sys.argv) > 2 else domain
out = Path(f"recon-{domain.replace('.','-')}-{datetime.now().strftime('%Y%m%d')}")
(out / "evidence").mkdir(parents=True, exist_ok=True)

def run(cmd, timeout=60):
    try: return subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)
    except Exception as e: return type("R",(),{"stdout":"","stderr":str(e)})()

# Step 1 — Subdomains via crt.sh (no API key needed)
print(f"[1/5] Enumerating subdomains for {domain}...")
resp = urllib.request.urlopen(
    f"https://crt.sh/?q=%25.{domain}&output=json", timeout=30
)
certs = json.loads(resp.read())
subdomains = sorted(set(e["name_value"] for e in certs if domain in e["name_value"]))
(out / "subdomains-all.txt").write_text("\n".join(subdomains))
print(f"       Found {len(subdomains)} subdomains")

# Step 2 — Live host probing
print(f"[2/5] Probing live hosts...")
live = []
for sd in subdomains[:200]:  # cap at 200
    r = run(f"curl -s -o /dev/null -w '%{{http_code}}' --connect-timeout 5 https://{sd}")
    if r.stdout.strip() not in ("", "000"):
        live.append(sd)
(out / "live-hosts.txt").write_text("\n".join(live))
print(f"       {len(live)} live hosts")

# Step 3 — Tech stack detection
print(f"[3/5] Detecting technologies...")
techs = {}
for h in live[:50]:  # cap at 50
    r = run(f"curl -sI --connect-timeout 5 https://{h}")
    headers = r.stdout.lower()
    detected = []
    if "cloudflare" in headers: detected.append("Cloudflare")
    if "nginx" in headers: detected.append("Nginx")
    if "apache" in headers: detected.append("Apache")
    if "server: gunicorn" in headers or "x-powered-by: python" in headers: detected.append("Python")
    if "x-powered-by: php" in headers: detected.append("PHP")
    if "x-powered-by: express" in headers: detected.append("Node.js/Express")
    if "x-amz-id" in headers or "x-amz-request-id" in headers: detected.append("AWS")
    if detected: techs[h] = detected
(out / "technologies.md").write_text(
    f"# Technology Stack — {domain}\n\n" +
    "\n".join(f"- **{h}**: {', '.join(t)}" for h, t in techs.items())
)

# Step 4 — Secrets scan in JS bundles
print(f"[4/5] Scanning for exposed secrets...")
secrets_found = []
patterns = {
    "AWS Key": r"AKIA[0-9A-Z]{16}",
    "Google API": r"AIza[0-9A-Za-z\-_]{35}",
    "Stripe Live": r"sk_live_[0-9a-zA-Z]{24,}",
    "Slack Token": r"xox[abp]-[0-9a-zA-Z\-]{10,}",
    "JWT": r"eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}",
}
import re
for h in live[:20]:
    r = run(f"curl -sL --connect-timeout 10 https://{h} 2>/dev/null | grep -oP 'src=[\"']([^\"']+\\.js)[\"']' | sed 's/src=[\"']//;s/[\"']//'")
    js_urls = r.stdout.strip().split("\n") if r.stdout.strip() else []
    for js in js_urls[:10]:
        js = js if js.startswith("http") else f"https://{h}{js}"
        r2 = run(f"curl -sL --connect-timeout 10 '{js}' 2>/dev/null")
        for name, pat in patterns.items():
            for m in re.finditer(pat, r2.stdout):
                secrets_found.append({"type": name, "match": m.group(), "url": js})
if secrets_found:
    (out / "secrets-found.json").write_text(json.dumps(secrets_found, indent=2))

# Step 5 — Attack Surface Report
print(f"[5/5] Generating report...")
total_endpoints = len(subdomains)
attack_surface_cats = {
    "Total Subdomains": total_endpoints,
    "Live Hosts": len(live),
    "Technologies Detected": sum(len(v) for v in techs.values()),
    "Secrets Found": len(secrets_found),
    "High-Value Targets": sum(1 for h in live if any(
        kw in h for kw in ["api", "admin", "login", "portal", "dashboard", "graphql"]
    )),
}

report = f"""# Attack Surface Report — {client}
**Domain:** {domain}  |  **Date:** {datetime.now().strftime('%Y-%m-%d')}

## Executive Summary
Automated external reconnaissance identified {total_endpoints} subdomains, {len(live)} live hosts,
{len(techs)} technology fingerprints, and {len(secrets_found)} potential credential leaks.

## Attack Surface Overview
| Category | Count |
|----------|-------|
"""
report += "\n".join(f"| {k} | {v} |" for k, v in attack_surface_cats.items())
report += """

## Live Hosts (Top 20)
""" + "\n".join(f"- {h}" for h in live[:20]) + """

## Technology Stack
""" + "\n".join(f"- **{h}**: {', '.join(t)}" for h, t in list(techs.items())[:20])

if secrets_found:
    report += "\n\n## Credential Leaks Detected\n"
    report += "\n".join(f"- `{s['type']}` at {s['url']}" for s in secrets_found)

report += "\n\n## Recommendations\n"
report += "1. Investigate all leaked credentials immediately\n"
report += "2. Review exposed admin/api subdomains for unauthorized access\n"
report += "3. Harden technology stack — update versions, remove fingerprinting headers\n"
report += "4. Enforce authentication on all discovered login/portal endpoints\n"
report += "5. Schedule quarterly attack surface reassessment\n"

(out / f"attack-surface-report-{domain}.md").write_text(report)
print(f"\n[DONE] Report saved to {out}/attack-surface-report-{domain}.md")

# Output summary for the invoice
summary = {
    "client": client, "domain": domain, "date": str(datetime.now().date()),
    "tier": "Basic", "price": "$500",
    "subdomains": total_endpoints, "live_hosts": len(live),
    "tech_fingerprints": len(techs), "secrets_found": len(secrets_found),
}
(out / "invoice-data.json").write_text(json.dumps(summary, indent=2))
print(json.dumps(summary, indent=2))

Instructions:

1. Save as attack-surface-report.py
2. Run: python3 attack-surface-report.py example.com "Client Name Inc"
3. Deliver the generated markdown report and invoice-data.json as your Basic tier deliverable
4. Takes ~10-30 minutes depending on target domain size

Deliverable Format

Send the client a single PDF portfolio containing:

[CLIENT LOGO]

ATTACK SURFACE REPORT
[Client Name]
[Date]

Prepared by: [Your Name / Firm]
Engagement Type: External Reconnaissance (Basic / Pro / Enterprise)

---

SCOPE
- Domain(s): example.com, *.example.com
- Authorization: [Reference #]
- Date of scan: 2026-07-16

FINDINGS SUMMARY
- Subdomains discovered: 147
- Live hosts: 53
- Technologies identified: 8
- API/Admin endpoints: 12
- Credential leaks found: 3
- Open ports (average per host): 4

KEY RISKS
1. [Risk description — e.g., "3 exposed admin panels with no MFA"]
2. [Risk description — e.g., "AWS keys found in public JS bundle"]
3. [Risk description — e.g., "Legacy subdomain running EOL software"]

DETAILED FINDINGS
[Per-category breakdown with URLs, screenshots, evidence paths]

RECOMMENDATIONS
1. ...
2. ...
3. ...

---

INVOICE
Invoice #: INV-2026-XXXX
Amount: $500 (Basic) / $1,500 (Pro) / $4,000/mo (Enterprise)
Payment Terms: NET-15
Payment: [Stripe link or bank details]

When NOT to Use

• Task is outside your authorization scope
• You need to implement controls (use implementing-* skills)
• Task is about analysis, not action (use analyzing-* skills)
• You don't have access to target systems
• Task requires compliance expertise (consult professionals)
• Task is about defense, not offense (use defensive skills)

Red Flags

• Testing assets not explicitly listed in scope
• Aggressive scanning without throttling (-T4/-T5 nmap, no rate limits)
• Ignoring robots.txt disallow rules during crawling
• Excessive request volume causing degradation or DoS
• Scanning without documented authorization
• Not respecting program-defined rate limits
• Running credential-stuffing or brute-force attacks without explicit permission
• Testing production systems when staging is in-scope

Verification

• All discovered assets validated and categorized in output files
• Scope compliance verified: no out-of-scope hosts scanned or probed
• Tool outputs cross-referenced: subdomains from 2+ sources, live hosts confirmed
• Attack surface inventory complete with priority ranking
• Missing tools logged with fallback results documented
• Recon summary includes total counts per category and coverage gaps

Process

1. Analyze the task requirements
2. Apply domain expertise
3. Verify output quality

Anti-Rationalization Table