القائمة
Safe first-pass web reconnaissance workflow for browser-assisted pentesting. Use when starting assessment on a web app, mapping exposed pages and flows, collecting passive evidence, or deciding whether deeper scripted discovery such as dirsearch, nmap, or sqlmap is justified.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Scoped web content discovery with the bundled dirsearch source tree. Use when the operator explicitly asks for dirsearch, directory enumeration, hidden file discovery, content brute forcing, or low-risk path discovery on authorized HTTP or HTTPS targets.
DNS out-of-band (OOB) reflection / exfiltration via CEYE platform. Use when the operator asks for DNS OOB testing, out-of-band data exfiltration, blind injection verification via DNS, or CEYE record queries.
Scoped host-level reconnaissance with the bundled Nmap distribution. Use when the operator explicitly asks for nmap, port scanning, service enumeration, host reachability checks, or low-risk host discovery on authorized targets.
Scoped SQL injection verification with the bundled sqlmap source tree. Use when the operator explicitly asks for sqlmap, SQL injection testing, raw HTTP request replay, form or anti-CSRF-aware injectable parameter verification, or conservative database fingerprinting and schema enumeration on authorized HTTP or HTTPS targets.
| name | recon-web |
| description | Safe first-pass web reconnaissance workflow for browser-assisted pentesting. Use when starting assessment on a web app, mapping exposed pages and flows, collecting passive evidence, or deciding whether deeper scripted discovery such as dirsearch, nmap, or sqlmap is justified. |
| activation | auto |
| version | 1.0 |
| tags | ["recon","web","browser"] |
| requires_browser | true |
| requires_tools | ["browser_navigate","browser_snapshot","browser_list_forms","browser_list_links","browser_extract_route_hints","analyze_security_headers","http_discover_surface","http_request","list_skill_scripts","record_finding"] |
| when_to_use | When starting a new web assessment, mapping pages and flows, or doing initial passive reconnaissance. |
Use this skill when assessing a web app for the first time.
browser_status, then navigate to the start page with browser_navigate.browser_snapshot(max_chars=8000, max_forms=40, max_inputs=40, max_links=120, storage_items=50).browser_list_forms(max_forms=40, max_inputs=40) and links with browser_list_links(limit=120).http_discover_surface(url=..., max_pages=6, max_candidates_per_page=40, max_passive_files=8) early to perform shallow same-origin discovery, passive file collection, and route/API hint extraction.browser_extract_route_hints(max_html_chars=30000, max_response_bodies=60, max_candidates=120) to mine the current DOM and recent XHR/fetch/script/document bodies for hidden routes, API endpoints, docs, and SPA navigation targets.analyze_security_headers.list_skill_scripts() during reconnaissance when the surface still looks incomplete or likely extends beyond what browser and HTTP passive discovery have exposed.dirsearch-recon through run_skill_script(...) instead of writing ad-hoc sandbox brute-force code.nmap-recon through run_skill_script(...) instead of one-off sandbox scanning code.sqlmap-sqli through run_skill_script(...) instead of ad-hoc sandbox verification scripts unless the operator explicitly asks for custom exploit development.record_finding.dirsearch-recon is the preferred on-demand helper for scoped content discovery. Start with list_skill_scripts(skill_name="dirsearch-recon"), then run_skill_script(skill_name="dirsearch-recon", script_name="dirsearch_status.py"), then dirsearch_scan.py.nmap-recon is the preferred on-demand helper for scoped host and port discovery. Start with list_skill_scripts(skill_name="nmap-recon"), then run_skill_script(skill_name="nmap-recon", script_name="nmap_status.py"), then nmap_scan.py.sqlmap-sqli is the preferred helper for scoped SQL injection verification on explicit targets. Start with list_skill_scripts(skill_name="sqlmap-sqli"), then run_skill_script(skill_name="sqlmap-sqli", script_name="sqlmap_status.py"), then sqlmap_scan.py.http_discover_surface before moving to heavier scripted discovery so the first pass already includes robots.txt, sitemap entries, manifest hints, and shallow same-origin traversal.browser_extract_route_hints on SPAs or authenticated flows where the interesting surface lives in inline scripts, network responses, or front-end route tables instead of visible links.cdp_send only when the higher-level browser tools are insufficient.