القائمة
Deep reconnaissance review and attack surface mapping. Analyzes gathered recon data to identify exposed services, entry points, technology stacks, and potential attack vectors.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
| name | indepth-recon-analysis |
| description | Deep reconnaissance review and attack surface mapping. Analyzes gathered recon data to identify exposed services, entry points, technology stacks, and potential attack vectors. |
| applyTo | **/* |
Systematically analyze reconnaissance data to map the full attack surface of a target. Identify exposed services, technology stacks, entry points, data flows, and potential weaknesses. Transform raw recon into actionable intelligence for downstream security skills.
| Input | Description | Required |
|---|---|---|
governance_context | Active engagement governance record | Yes |
target | Target application, domain, or repository | Yes |
recon_data | Any combination of: subdomain lists, port scans, HTTP responses, technology fingerprints, directory listings, source code, API documentation | At least one |
Scope Verification — Confirm all recon targets are within authorized scope.
Asset Inventory — Catalog all discovered assets:
Technology Fingerprinting — Identify:
Entry Point Mapping — For each endpoint, identify:
Data Flow Analysis — Map:
Exposure Assessment — Flag:
.git directoriesAttack Vector Identification — For each significant entry point:
web-common-risks.md)Route Findings — Send identified vectors to appropriate skills via bug-bounty-triage
## Recon Analysis: [Target]
### Asset Inventory
| Asset | Type | Technology | Auth Required | Notes |
|-------|------|-----------|---------------|-------|
| app.example.com | Web App | React + Express | Yes | Main application |
| api.example.com/v2 | REST API | Node.js | Bearer token | API v2 |
| admin.example.com | Admin Panel | React | Yes (MFA) | Staff only |
### Technology Stack
| Layer | Technology | Version | Notes |
|-------|-----------|---------|-------|
| Web Server | nginx | 1.24.x | Via Server header |
| Application | Express.js | Unknown | Via response patterns |
| Frontend | React | 18.x | Via JS bundles |
| Database | PostgreSQL | Unknown | Via error messages |
### Entry Points
| Endpoint | Method | Inputs | Auth | Priority |
|----------|--------|--------|------|----------|
| /api/v2/users/:id | GET | path param (id) | Bearer | High — IDOR candidate |
| /api/v2/upload | POST | multipart file | Bearer | High — file upload |
| /login | POST | email, password | None | Medium — auth testing |
| /search | GET | q (query param) | None | Medium — injection candidate |
### Exposure Findings
| Finding | Severity | Confidence | Notes |
|---------|----------|------------|-------|
| .git directory accessible | S3 | C2 | Returns 200, needs content verification |
| Admin panel no IP restriction | S3 | C2 | Publicly accessible, has MFA |
| Server version in headers | S5 | C1 | nginx/1.24.0 exposed |
### Recommended Testing Priority
1. [High] IDOR testing on /api/v2/users/:id — sequential IDs observed
2. [High] File upload abuse on /api/v2/upload — test extension/type bypass
3. [Medium] SQL/NoSQL injection on /search — unparameterized query suspected
4. [Medium] Authentication flow analysis — test rate limiting, enumeration
references/web-common-risks.md — Vulnerability taxonomy for vector identificationreferences/authz-and-authn-checklist.md — Authentication entry point analysisreferences/severity-matrix.md — Severity classificationAudit Active Directory, LDAP, and enterprise identity infrastructure for misconfigurations, privilege escalation paths, Kerberos weaknesses, trust relationship abuse, and credential exposure.
API-specific security testing for REST, GraphQL, WebSocket, and gRPC endpoints. Covers authentication, authorization, injection, rate limiting, mass assignment, and API-specific attack patterns.
Intake, deduplication, severity assignment, and prioritization of security findings for bug bounty and pentest engagements. Processes raw findings into actionable triaged items.
Audit CI/CD pipelines and software supply chains for poisoning vectors, secret exposure, artifact tampering, dependency confusion, and build environment compromise. Covers GitHub Actions, GitLab CI, Jenkins, and container build pipelines.
Audit cloud infrastructure configuration for security misconfigurations across AWS, Azure, and GCP. Covers IAM, storage, networking, compute, and logging. Reviews IaC templates (Terraform, CloudFormation, Pulumi).
Assess container runtime security including escape paths, kernel exploitation, capability abuse, namespace breakouts, and orchestration runtime issues beyond static configuration review.