Menu
Comprehensive reconnaissance — passive OSINT, subdomain enumeration, port scanning, technology fingerprinting
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Basé sur la classification professionnelle SOC
API security testing — REST, GraphQL, authentication, authorization, rate limiting, business logic
Network penetration testing — service enumeration, vulnerability scanning, credential auditing, Active Directory
Master pentest orchestration — full pipeline from target to report with confirmation gates
Generate professional penetration testing reports from findings
Web application penetration testing — XSS, SQLi, CSRF, SSRF, command injection, file upload, WAF bypass
Code security testing — SAST, SCA, secret detection, container scanning, IaC analysis
| name | pentest_recon |
| description | Comprehensive reconnaissance — passive OSINT, subdomain enumeration, port scanning, technology fingerprinting |
| triggers | ["recon","reconnaissance","enumerate","subdomain","port scan","fingerprint"] |
Perform comprehensive reconnaissance against a target.
Passive recon first (no direct contact):
whois {target}dig {target} ANY, dig {target} A MX TXT NS CNAME SOAsubfinder -d {target} -all -recursive -o /tmp/subdomains-subfinder.txtcurl -s "https://crt.sh/?q=%.{target}&output=json" | jq -r '.[].name_value' | sed 's/\*\.//g' | sort -u > /tmp/subdomains-crtsh.txtcat /tmp/subdomains-*.txt | sort -u > /tmp/subdomains-all.txtActive recon (after passive completes):
cat /tmp/subdomains-all.txt | httpx -silent -status-code -title -tech-detect -web-server -o /tmp/live-hosts.txtnmap -sV -sC -O --top-ports 1000 -T4 --open -oA /tmp/nmap-top {target}whatweb {target} -a 3 -v -o /tmp/whatweb.txtSummarize findings with counts for subdomains, live hosts, open ports, technologies.