Menu
Use when starting or restructuring an authorized external web and API assessment.
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/uphiago/recon-skills --skill recon-playbookThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Showing SKILL.md
Full WSTG-aligned web application pentest — 12-phase methodology from information gathering through reporting, with concrete commands, expected outputs, pitfalls, and verification per phase.
Attack SAML SSO via XSW, signature strip, metadata extract.
Use when two or more verified findings may combine into a higher-impact authorized attack path.
Based on SOC occupation classification
| name | recon-playbook |
| description | Use when starting or restructuring an authorized external web and API assessment. |
| version | 2.0.0 |
| license | MIT |
| platforms | ["linux","macos"] |
| compatibility | Requires curl, jq, subfinder, dnsx, httpx, katana, and optional nmap |
| tags | ["meta","recon","web","api","workflow"] |
| category | meta |
| related_skills | ["attack-patterns-reference","evidence-hygiene","offensive-osint","port-service-discovery","report-writing","subdomain-enumeration","triage-validation","web-enumeration","web2-recon"] |
Use this playbook to turn an authorized root domain or asset list into a prioritized map of web applications, APIs, authentication boundaries, and testable security hypotheses.
scope
-> assets
-> DNS and services
-> routes and client code
-> APIs and identities
-> hypotheses
-> focused validation
-> evidence and reporting
Do not use this playbook to justify activity outside the agreed scope or to run every available tool against every asset.
curl, jq, subfinder, dnsx, httpx, and katana.nmap only when IP or port discovery is in scope.export TARGET="example.test"
export OUTPUT_DIR="${OUTPUT_DIR:-./output/$TARGET}"
mkdir -p \
"$OUTPUT_DIR/assets" \
"$OUTPUT_DIR/http" \
"$OUTPUT_DIR/urls" \
"$OUTPUT_DIR/evidence"
Run each phase only after reviewing the preceding output. Keep raw source files so every hostname, URL, and hypothesis has provenance.
Keep a short operator-readable scope record beside the output:
allowed: *.example.test
excluded: status.example.test
identities: anonymous, test-user-a, test-user-b
request rate: 2 requests/second/host
state changes: synthetic records only
The scope must answer what may be tested, which identities may be used, how much traffic is acceptable, and whether a state-changing test is allowed.
subfinder -d "$TARGET" -silent \
> "$OUTPUT_DIR/assets/subfinder.txt"
curl -sS --max-time 30 \
"https://crt.sh/?q=%25.${TARGET}&output=json" \
| jq -r '.[].name_value' \
| sed 's/^\*\.//' \
> "$OUTPUT_DIR/assets/crtsh.txt"
cat "$OUTPUT_DIR/assets/subfinder.txt" \
"$OUTPUT_DIR/assets/crtsh.txt" \
| tr '[:upper:]' '[:lower:]' \
| grep -E '^[a-z0-9.-]+\.[a-z]{2,}$' \
| sort -u \
> "$OUTPUT_DIR/assets/hostnames.txt"
Review wildcard results, certificate SANs, third-party CNAMEs, and excluded assets before active probing.
dnsx \
-l "$OUTPUT_DIR/assets/hostnames.txt" \
-silent -a -aaaa -cname -json \
-o "$OUTPUT_DIR/assets/dns.jsonl"
httpx \
-l "$OUTPUT_DIR/assets/hostnames.txt" \
-threads 10 \
-rate-limit 2 \
-status-code -title -tech-detect -server -ip -cname \
-json \
-o "$OUTPUT_DIR/http/services.jsonl"
jq -r '.url // empty' "$OUTPUT_DIR/http/services.jsonl" \
| sort -u \
> "$OUTPUT_DIR/http/live-urls.txt"
Treat technology labels and banners as routing signals. Confirm important components from more than one source before associating a vulnerability.
katana \
-list "$OUTPUT_DIR/http/live-urls.txt" \
-silent -jc -kf all \
-c 2 -p 2 -rl 2 \
-o "$OUTPUT_DIR/urls/katana.txt"
grep -Ei '/api/|/graphql|swagger|openapi|/rest/' \
"$OUTPUT_DIR/urls/katana.txt" \
> "$OUTPUT_DIR/urls/api-candidates.txt"
grep -Ei 'login|logout|register|reset|oauth|saml|callback|session|token' \
"$OUTPUT_DIR/urls/katana.txt" \
> "$OUTPUT_DIR/urls/auth-candidates.txt"
grep -Ei '\.js([?#].*)?$' "$OUTPUT_DIR/urls/katana.txt" \
> "$OUTPUT_DIR/urls/javascript.txt"
Map current routes before adding archive sources. Historical URLs are useful for discovery, but they do not prove that an endpoint remains reachable.
For each application, record:
Authorization testing needs at least two approved identities when the claim depends on cross-user or cross-tenant access.
Use attack-patterns-reference to classify observations, then open only the
skills supported by current evidence. Common routes include:
| Observation | Follow-up skill |
|---|---|
| JavaScript bundles or source maps | js-secrets-extraction, source-leak-hunt |
| REST objects and identifiers | hunt-api-misconfig, hunt-idor |
| GraphQL endpoint | hunt-graphql |
| OAuth or SAML flow | hunt-oauth, hunt-saml |
| WordPress surface | hunt-wordpress, wordpress-plugin-hunt |
| Public service port | port-service-discovery |
| Candidate multi-step path | cross-attack-chains |
Write the hypothesis before the probe:
Expected: user A cannot read user B's synthetic object.
Test: repeat the same object request with both approved sessions.
Positive evidence: user A receives user B's object and its non-public fields.
Negative control: an unknown object returns the documented not-found response.
Stop condition: any access to non-synthetic or out-of-scope data.
Use triage-validation before reporting. A status code, scanner label, version
string, or permissive-looking header is not sufficient by itself.
For every material result, retain:
Use evidence-hygiene while testing and report-writing after validation.
200 for nonexistent sensitive paths.OUTPUT_DIR.