Menú
Strategic reconnaissance planning for external attack surface management. Use when starting a new engagement, choosing initial scan strategy, or deciding how to expand coverage after initial results.
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Basado en la clasificación ocupacional SOC
Use when beginning a web assessment from a domain, wildcard, ASN, organization, IP list, or CIDR and measurable attack-surface coverage is needed.
Decision tree for selecting AIRT attacks based on goals, target type, and constraints
Common Active Directory attack chains with tool mappings. Covers Kerberoasting, AS-REP roasting, RBCD, AD CS, DCSync, relay attacks, and credential reuse patterns. Use during exploitation and privilege escalation phases.
Decision tree for Active Directory enumeration. Maps enumeration tasks to tools, defines priority signals, and specifies what findings trigger deeper investigation. Use during the enumeration phase of network operations.
Load when performing network operations or Active Directory exploitation. Enforces enumeration-before-attack discipline, credential verification, trust boundary awareness, scope compliance, reversibility preference, and structured reporting. Prevents premature exploitation, credential misuse, and scope violations.
Direct Caido interaction via the caido-sdk-client Python library, bypassing the Caido MCP server. Prefer this over the caido-proxy MCP skill for efficiency WHEN the SDK is importable in the current runtime. If the import fails, or Caido/the MCP is not loaded, fall back to the caido-proxy skill.
| name | reconnaissance-planning |
| description | Strategic reconnaissance planning for external attack surface management. Use when starting a new engagement, choosing initial scan strategy, or deciding how to expand coverage after initial results. |
Start with passive techniques to map the target without generating traffic.
Subdomain Enumeration:
run_bbot_scan(targets=["target.com"], presets=["subdomain-enum"], flags=["passive"])
This queries certificate transparency logs, DNS databases, archive.org, and OSINT sources without touching the target directly.
What to look for after Phase 1:
app01, srv02 suggest more exist)Probe discovered assets to understand what's running.
Web service detection + technology fingerprinting:
run_bbot_scan(targets=["target.com"], presets=["subdomain-enum", "web-basic"])
Port scanning on key IPs:
run_bbot_scan(targets=["10.0.0.1"], modules=["portscan"], config=["modules.portscan.ports=top_1000"])
What to look for after Phase 2:
Focus on high-value targets identified in Phase 2.
Vulnerability scanning on interesting hosts:
run_bbot_scan(targets=["api.target.com"], presets=["nuclei"])
Web spidering on complex applications:
run_bbot_scan(targets=["app.target.com"], presets=["spider"], config=["web.spider_distance=2", "web.spider_depth=3"])
Screenshot collection for visual triage:
run_bbot_scan(targets=["target.com"], modules=["gowitness"], presets=["subdomain-enum"])
Cloud resource enumeration:
run_bbot_scan(targets=["target.com"], presets=["cloud-enum"])
Is this a new target with no prior data?
├── YES → Start with Phase 1 (passive subdomain-enum)
└── NO → Do you have subdomains but no service info?
├── YES → Run web-basic + tech-detect
└── NO → Do you have services but no vuln data?
├── YES → Run nuclei on interesting hosts
└── NO → Focus on graph analysis and synthesis
| Target Size | Approach |
|---|---|
| Single domain | kitchen-sink preset covers everything |
| Small org (< 50 subdomains) | Full phased approach, thorough coverage |
| Medium org (50-500 subdomains) | Passive first, then targeted active scans on high-value assets |
| Large org (500+ subdomains) | Passive + selective active, prioritize by naming/business context |
kitchen-sink on a large target. You'll drown in data.--whitelist or --strict-scope for targets with clear boundaries.