القائمة
Comprehensive reconnaissance — passive OSINT, subdomain enumeration, port scanning, technology fingerprinting
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
API security testing — REST, GraphQL, authentication, authorization, rate limiting, business logic
Network penetration testing — service enumeration, vulnerability scanning, credential auditing, Active Directory
Master pentest orchestration — full pipeline from target to report with confirmation gates
Generate professional penetration testing reports from findings
Web application penetration testing — XSS, SQLi, CSRF, SSRF, command injection, file upload, WAF bypass
Code security testing — SAST, SCA, secret detection, container scanning, IaC analysis
| name | pentest_recon |
| description | Comprehensive reconnaissance — passive OSINT, subdomain enumeration, port scanning, technology fingerprinting |
| triggers | ["recon","reconnaissance","enumerate","subdomain","port scan","fingerprint"] |
Perform comprehensive reconnaissance against a target.
Passive recon first (no direct contact):
whois {target}dig {target} ANY, dig {target} A MX TXT NS CNAME SOAsubfinder -d {target} -all -recursive -o /tmp/subdomains-subfinder.txtcurl -s "https://crt.sh/?q=%.{target}&output=json" | jq -r '.[].name_value' | sed 's/\*\.//g' | sort -u > /tmp/subdomains-crtsh.txtcat /tmp/subdomains-*.txt | sort -u > /tmp/subdomains-all.txtActive recon (after passive completes):
cat /tmp/subdomains-all.txt | httpx -silent -status-code -title -tech-detect -web-server -o /tmp/live-hosts.txtnmap -sV -sC -O --top-ports 1000 -T4 --open -oA /tmp/nmap-top {target}whatweb {target} -a 3 -v -o /tmp/whatweb.txtSummarize findings with counts for subdomains, live hosts, open ports, technologies.