pentest-recon

name	pentest-recon
description	Reconnaissance and enumeration advisory — Nmap/Nessus/Nikto/BloodHound output parsing, attack surface prioritization, next-step suggestions. Includes OSINT (domain recon, email harvest, breach data). Triggers on recon, reconnaissance, enumeration, Nmap output, attack surface, target prioritization, subdomain enum, port scan analysis, OSINT, domain recon.
license	MIT
compatibility	Works with Claude Code
allowed-tools	Read Write Edit Bash Grep
metadata	{"author":"badi","homepage":"https://github.com/fatihkan/badi-skills/tree/main/skills/pentest-recon","badi-version":">=1.24.0","category":"pentest","scope":"advisory","inspired-by":"0xSteph/pentest-ai-agents recon-advisor + osint-collector"}

pentest-recon

Recon output analysis + attack-surface prioritization + next-step suggestions. Advisory mode — the user pastes output, the skill analyzes it. Active command composing requires a scope declaration.

Triggers

• "nmap output" / "review the scan result"
• "Nessus report"
• "I ran a subdomain enum"
• "where is the attack surface"
• "which target is the priority"
• "BloodHound graph analysis"
• "let's do OSINT"

Input Types

Input	Skill Behavior
Nmap XML/text output	Port + service + version + script output parse, CVE lookup suggestion
Nessus / OpenVAS report	Severity + CVSS prioritize, critical findings list
Nikto output	Web vulnerability filtering, false positives weeded out
BloodHound JSON	Find high-value target paths, attack path prioritization
Masscan/Naabu output	Open-port list -> service enum suggestion
WHOIS / certificate transparency	Subdomain expansion, additional domain discovery

Output Template

## Recon Analysis — <target>

### Detection
- 3 open ports: 22/SSH, 80/HTTP, 443/HTTPS
- HTTP: nginx 1.18.0 (CVE-2021-23017)
- HTTPS: Self-signed cert, expired 2024-03-15
- SSH: OpenSSH 7.6p1 (CVE-2018-15473)

### Prioritization
1. [HIGH] CVE-2021-23017 — nginx DNS resolver — exploitable, public PoC available
2. [MEDIUM] OpenSSH user enum (CVE-2018-15473) — username discovery
3. [LOW] Cert expired — config issue, no exploitation value

### Next Step (suggested)
- Active: `nikto -h <target>` (MODERATE OPSEC)
- Passive: SecurityTrails / Censys additional subdomains (QUIET)
- Targeted: nginx version-specific exploit-db search

### Skipped Areas
- UDP scan not done (53, 161 standard practice)
- Vhost discovery skipped

Active Command Composing (Scope Required)

If the user grants scope approval, the skill can suggest the following commands (with examples):

# QUIET — passive subdomain enum
subfinder -d example.com -silent

# MODERATE — TCP service scan, rate-limited
nmap -sT -sV --top-ports 1000 --max-rate 100 -oA scan_example_$(date +%Y%m%d_%H%M%S) <target>

# MODERATE — HTTP fingerprint
httpx -l hosts.txt -title -tech-detect -status-code -o httpx-results.txt

# QUIET — Cert transparency
curl for crt.sh: 'https://crt.sh/?q=%25.example.com&output=json'

Every command is explained first, then run via the Bash tool (on user approval). An evidence file is created.

OSINT (passive collection)

Source	Data	OPSEC
crt.sh	Subdomain (cert transparency)	QUIET
Shodan API	Open ports + banners	QUIET (authorized API)
Censys	TLS cert + port	QUIET
haveibeenpwned API	Email breach hit	QUIET
theHarvester	Email + employee	QUIET-MODERATE
LinkedIn (manual)	Employee role + dept	QUIET
GitHub search	Code leak, secret exposure	QUIET
Wayback Machine	Old endpoint, deprecated path	QUIET

Prioritization Logic

Factor	Weight
Public exploit availability (Exploit-DB, PoC repo)	x3
CVSS >= 9.0	x3
Unauthenticated remote	x2
Internet-facing	x2
Likely default credential	x2
Known RCE service (Tomcat manager, Jenkins, Confluence)	x3

Sort by score -> focus on the top 5 targets.

Out-of-Scope

• Running live exploits (see domain-specific skills like pentest-web, pentest-ad)
• Authoritative DNS zone transfer against external targets (DoS risk)
• Mass scan public internet