From cybersecurity-skills
Performs structured reconnaissance and attack surface enumeration for authorized pentests, CTFs, and bug bounty programs. Handles passive recon (DNS, WHOIS, certificate transparency, dorking), active scanning (nmap, web content discovery, SSL analysis), and organizes findings into an actionable map.
How this skill is triggered — by the user, by Claude, or both
Slash command
/cybersecurity-skills:reconThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
Perform structured reconnaissance against an authorized target, organizing findings into an actionable attack surface map.
Perform structured reconnaissance against an authorized target, organizing findings into an actionable attack surface map.
Cross-references: osint-recon for the deeper open-source-intelligence pass (people, organizations, historical data) — this skill is the active/passive target-mapping side, osint-recon is the broader investigative side; they pair naturally. web-pentest for the next stage once recon has produced an attack surface map and an authorized target list. owasp-audit for source-code review when you have access to the target's code.
Before running any commands, confirm:
If authorization is unclear, ask before proceeding. Never assume authorization.
Gather information without touching the target directly.
DNS enumeration:
dig any $ARGUMENTS for A, AAAA, MX, TXT, NS, CNAME recordsdig axfr @ns-server $ARGUMENTScurl -s "https://crt.sh/?q=%25.$ARGUMENTS&output=json" | jq -r '.[].name_value' | sort -u
WHOIS and registration: Run whois $ARGUMENTS for registrant, nameserver, and creation date info.
Search engine dorking: Use targeted queries — site:, inurl:, filetype:, intitle: — to find exposed pages, documents, and admin panels.
Technology fingerprinting: Identify frameworks, CMS, server software, and JavaScript libraries from public-facing pages.
Public code repositories: Search GitHub/GitLab for the target's org name, domain, API keys, or internal paths.
Historical data: Check the Wayback Machine for old endpoints, removed pages, and configuration files.
Port scanning:
nmap -sC -sV -oN scan-results.txt $ARGUMENTS
Start with top 1000 ports. Expand to full range (-p-) if needed. Use -Pn if the host appears down but is in scope.
Service enumeration: Based on open ports, probe for version info and default configurations.
Web content discovery:
/api/, /v1/, /graphql, /swagger.json)SSL/TLS analysis: Run testssl.sh or sslyze to check for weak ciphers, expired certificates, and misconfigurations.
Correlate all findings. Identify the most promising attack vectors and prioritize by:
Produce a structured recon report:
# Recon Report
## Target: [target]
## Scope: [confirmed scope]
## Date: [date]
### Passive Findings
| Finding | Details | Relevance |
|---------|---------|-----------|
### Subdomains Discovered
- [list]
### Technologies Detected
- [list with versions where identified]
### Active Findings
| Port | Service | Version | Notes |
|------|---------|---------|-------|
### Attack Surface Summary
[Prioritized list of interesting findings with risk assessment]
### Recommended Next Steps
[Ordered list of what to investigate further]
npx claudepluginhub briiirussell/cybersecurity-skills --plugin cybersecurity-skillsAutomates reconnaissance pipelines for bug bounty hunting: subdomain enumeration, live host discovery, tech fingerprinting. Uses Amass, Subfinder, httpx, Nuclei.
Scope-aware bug bounty recon methodology covering passive enumeration, subdomain discovery, asset attribution, tech stack fingerprinting, and content discovery. Use at the start of a bounty engagement.
Maps web application attack surface through subdomain discovery, port scanning, endpoint enumeration, and API detection, with vhost and wildcard SSL analysis.