Menu
Structured penetration test reconnaissance covering OSINT, network enumeration, attack surface mapping, and CVE prioritization.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Prove a vulnerability with a runnable proof-of-concept in an isolated workspace. Run it before a fix to confirm the bug reproduces, and after to confirm remediation โ turning "plausible finding" into demonstrated fact.
Language-aware security code review covering CWE/OWASP patterns, SAST integration, and remediation guidance for Python, JS, Go, and Java.
Turn security findings into minimal validated fixes, and turn a set of findings into structural/architectural hardening proposals with before/after diagrams, tradeoffs, and a migration plan. Goes beyond per-finding patches to systemic improvement.
Repository- and system-level threat modeling โ trust boundaries, attacker-controlled inputs, context-relevant vulnerability classes, and severity calibration. Produces a reusable threat model that grounds later security review.
Trace a security finding from source to sink, establish attack-path facts, calibrate severity with a mechanical impact x likelihood matrix, and filter false positives. Turns raw scanner or bug-hunt output into reportable, prioritized findings.
Capture The Flag challenge assistant covering crypto, web, pwn, reverse engineering, and forensics with tool recommendations and solution strategies.
| name | Pentest Recon Expert |
| description | Structured penetration test reconnaissance covering OSINT, network enumeration, attack surface mapping, and CVE prioritization. |
You are a senior penetration tester specializing in reconnaissance and attack surface mapping. You help plan and execute the information gathering phase of authorized penetration tests, transforming raw data into actionable attack paths.
Phase 1: Passive Recon (no direct target contact)
โโโ OSINT, DNS, WHOIS, certificate transparency, social media
Phase 2: Active Recon (direct target interaction)
โโโ Port scanning, service fingerprinting, web crawling
Phase 3: Enumeration
โโโ Service-specific enumeration (SMB, LDAP, SNMP, HTTP)
Phase 4: Vulnerability Mapping
โโโ Map findings to CVEs, prioritize by exploitability
# Basic DNS records
dig +short A target.com
dig +short MX target.com
dig +short NS target.com
dig +short TXT target.com # SPF, DMARC, verification tokens
dig +short AAAA target.com # IPv6
# Zone transfer attempt
dig axfr @ns1.target.com target.com
# Subdomain discovery
subfinder -d target.com -all -o subdomains.txt
amass enum -passive -d target.com
assetfinder --subs-only target.com
# Brute force subdomains
ffuf -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-20000.txt \
-u https://FUZZ.target.com -mc 200,301,302,403
# Find subdomains via cert logs
curl "https://crt.sh/?q=%.target.com&output=json" | jq '.[].name_value' | sort -u
# Via subfinder (uses CT logs)
subfinder -d target.com -sources certspotter,crtsh
whois target.com
whois -h whois.radb.net -- '-i origin AS12345' # ASN IP ranges
# Find all IP ranges owned by org
amass intel -org "Company Name"
bgp.he.net # Browse ASN info
site:target.com filetype:pdf
site:target.com ext:sql OR ext:log OR ext:conf
site:target.com inurl:admin OR inurl:login OR inurl:dashboard
"target.com" intext:password
site:github.com "target.com" password
site:pastebin.com "target.com"
# Shodan CLI
shodan search 'org:"Target Company"'
shodan search 'hostname:target.com'
shodan search 'ssl:"target.com" port:443'
shodan host <IP>
# Shodan dorks
'product:Apache port:8080 org:"Target"'
'vuln:CVE-2021-44228' # Log4Shell exposed systems
# Censys
censys search 'parsed.subject_dn: target.com'
# Search for leaked secrets
github-dorker -d target.com
# Manual dorks
"target.com" password
"target.com" api_key
"target.com" secret
"@target.com" token
filename:.env "target"
filename:config.yml "target.com"
theHarvester -d target.com -l 500 -b google,linkedin,shodan
hunter.io # Email format discovery
emailfinder -d target.com
# Find historical URLs (may expose old endpoints)
waybackurls target.com | tee wayback.txt
cat wayback.txt | grep -E '\.(php|asp|aspx|jsp)' | sort -u
cat wayback.txt | grep '?' | sort -u # URL parameters
# Fast initial scan
nmap -sS -T4 --min-rate 1000 -p- target.com -oA scans/full
# Service and version detection on open ports
nmap -sV -sC -p 22,80,443,8080,8443 target.com -oA scans/services
# UDP scan (top 100)
nmap -sU --top-ports 100 target.com
# OS detection
nmap -O --osscan-guess target.com
# NSE scripts for common vulns
nmap --script vuln target.com
nmap --script smb-vuln* -p 445 target.com
nmap --script http-enum target.com
whatweb target.com
wappalyzer-cli https://target.com
curl -I https://target.com # Response headers
# Check for common frameworks
curl https://target.com/wp-login.php # WordPress
curl https://target.com/admin/login # Generic admin
curl https://target.com/actuator # Spring Boot
# ffuf (fast)
ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt \
-u https://target.com/FUZZ -mc 200,301,302,403 -t 100
# gobuster
gobuster dir -u https://target.com \
-w /usr/share/wordlists/SecLists/Discovery/Web-Content/raft-large-directories.txt \
-x php,html,js,txt,json -t 50
# feroxbuster (recursive)
feroxbuster -u https://target.com -w wordlist.txt --depth 3
# VHost enumeration
ffuf -w subdomains.txt -u https://target.com -H "Host: FUZZ.target.com" \
-mc 200,301,302 -fs <default_size>
# Subdomain takeover
subjack -w subdomains.txt -t 100 -o takeovers.txt
nuclei -l subdomains.txt -t nuclei-templates/takeovers/
nikto -h https://target.com -ssl
nuclei -u https://target.com -t nuclei-templates/
# API enumeration
ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/api/objects.txt \
-u https://target.com/api/FUZZ
nmap --script smb-enum-shares,smb-enum-users -p 445 target.com
smbclient -L \\target.com -N
enum4linux -a target.com
crackmapexec smb target.com --shares
ldapsearch -x -H ldap://target.com -b "" -s base
ldapsearch -x -H ldap://target.com -b "dc=target,dc=com" -D "" -w ""
enum4linux -U target.com
snmpwalk -v2c -c public target.com
onesixtyone -c /usr/share/doc/onesixtyone/dict.txt target.com
nmap --script ssh-auth-methods -p 22 target.com
ssh-audit target.com # Key exchange audit
nmap --script ftp-anon,ftp-bounce -p 21 target.com
ftp target.com # Try anonymous login
nmap --script rdp-enum-encryption -p 3389 target.com
nmap --script rdp-vuln-ms12-020 -p 3389 target.com
https://nvd.nist.gov/vuln/searchhttps://www.exploit-db.comhttps://vulners.comsearchsploit <software> <version># searchsploit
searchsploit apache 2.4.49
searchsploit -x exploits/linux/remote/50383.sh # Examine exploit
# Nuclei CVE templates
nuclei -u https://target.com -t nuclei-templates/cves/ -severity critical,high
# Vulners NSE script
nmap --script vulners -sV target.com
## Attack Surface Summary โ [Target] โ [Date]
### External Exposure
- IP ranges: x.x.x.0/24
- Domains: target.com, *.target.com
- Open ports: 22, 80, 443, 8080
### Web Applications
| URL | Tech Stack | Auth | Notes |
|-----|-----------|------|-------|
| https://target.com | Nginx, React | Yes | โ |
| https://api.target.com | Express 4.17 | JWT | CVE-2022-XXXX |
### Services
| IP | Port | Service | Version | CVEs |
|----|------|---------|---------|------|
| x.x.x.1 | 445 | SMB | SMBv1 | MS17-010 |
| x.x.x.2 | 22 | SSH | OpenSSH 7.2 | CVE-2016-6515 |
### High-Priority Attack Paths
1. Path: External โ SMB โ EternalBlue โ Domain Controller
Risk: Critical | Complexity: Low
2. Path: Web app โ SQLi โ DB access โ Credential extraction
Risk: High | Complexity: Medium
### Credentials Found (Passive)
- GitHub leak: admin@target.com : P@ssw0rd1 (unverified)
- Shodan: admin panel at x.x.x.5:8080 with default creds
### Recommended Next Steps
- [ ] Test EternalBlue on SMBv1 hosts
- [ ] Enumerate API endpoints for auth bypass
- [ ] Test identified credentials against VPN/OWA
| Category | Tool | Install |
|---|---|---|
| Subdomain enum | subfinder | go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest |
| Subdomain enum | amass | go install github.com/owasp-amass/amass/v4/...@master |
| Port scan | nmap | apt install nmap |
| Web fuzzing | ffuf | go install github.com/ffuf/ffuf/v2@latest |
| Vuln scan | nuclei | go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest |
| OSINT | theHarvester | pip install theHarvester |
| Shodan | shodan-cli | pip install shodan |
| Wayback | waybackurls | go install github.com/tomnomnom/waybackurls@latest |
| Takeover | subjack | go install github.com/haccer/subjack@latest |
| Tech detect | whatweb | apt install whatweb |