소스 정보
- 저장소
- uphiago/recon-skills
- 최근 소스 활동
- 2026년 7월 25일 16:54
- 감지된 SKILL.md 언어
- 영어
- 스타
- 1,158
- 포크
- 205
설치 방법
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
소스 파일 검토
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
메뉴
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/uphiago/recon-skills --skill visual-recon명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
SOC 직업 분류 기준
SKILL.md 표시 중
| name | visual-recon |
| description | Screenshot all live hosts for rapid visual triage and technology fingerprinting. |
| version | 1.1.0 |
| revision_date | "2026-07-25T00:00:00.000Z" |
| license | MIT |
| platforms | ["linux"] |
| compatibility | Requires curl, httpx, python3 |
| tags | ["recon","screenshot","visual","triage","fingerprinting","technology"] |
| category | recon |
| related_skills | ["subdomain-enumeration","web-enumeration","cms-detection","port-service-discovery"] |
Automatically screenshot every live host to triage hundreds of subdomains visually instead of manually opening each one. Combined with technology fingerprinting, this reveals technology stacks, default CMS install pages, admin panels, and misconfigured services at a glance. Process 500+ hosts in minutes and identify high-value targets by visual inspection.
terminal gowitness, httpx, and curl.gowitness installed: go install github.com/sensepost/gowitness@latest.subdomain-enumeration.gowitness file -f alive_subs.txt -P ./screenshots/ --no-http
# gowitness — fast, Go-based screenshot tool
gowitness file -f alive_subs.txt \
-P ./screenshots/ \
--no-http \
--timeout 15 \
--resolution-x 1440 \
--resolution-y 900
# With database for searchable results
gowitness file -f alive_subs.txt -P ./screenshots/ --no-http \
--db gowitness.db --chrome-window-x 1440 --chrome-window-y 900
# Query results
gowitness report list --db gowitness.db
gowitness report generate --db gowitness.db
# eyewitness — with HTML report generation
python3 EyeWitness.py \
-f alive_subs.txt \
--web \
-d ./eyewitness_output/ \
--timeout 15 \
--no-prompt
# Single-page applications need JS execution
gowitness single -u https://[SPA_COMPANY] \
-P ./screenshots/ \
--chrome-window-x 1440 --chrome-window-y 900
# Batch headless capture
cat spa_urls.txt | while read url; do
gowitness single -u -P ./screenshots/
Review screenshots for high-value patterns:
# Extract all titles from screenshots for quick filtering
gowitness report list --db gowitness.db \
| grep -iE "login|admin|dashboard|setup|install|phpmyadmin|jenkins|grafana|api|dev|staging|test"
# Look for default error pages (identifies specific web servers)
gowitness report list --db gowitness.db \
| grep -iE "404|403|502|503|default|maintenance|under construction"
What to look for:
| Screenshot shows | Meaning |
|---|---|
| WordPress install page | Fresh WordPress — test registration on /wp-admin/install.php |
| phpMyAdmin login | Database access panel — try default creds |
| Jenkins login | CI/CD server — check for unauthenticated access |
| Grafana/Prometheus | Monitoring dashboard — check for public data |
| IIS default page | Windows server — check for ASP.NET endpoints |
| Apache default page | Standard Linux server — check for server-status |
| Error stack traces | Debug mode enabled — extract server paths and versions |
| Directory listing | Readable file tree — check for config files |
| Login form on custom port | Internal admin panel — highest priority target |
# Compare screenshots across subdomains to find shared infrastructure
# Same visual = shared server = if one is vulnerable, all are
ls screenshots/ | cut -d'-' -f1 | sort | uniq -c | sort -rn
# High count of identical-looking sites = mass vulnerability potential
# whatweb — identifies CMS, frameworks, servers
whatweb -i alive_subs.txt -a 3 -t 50 --log-brief=cms_results.txt
# wappalyzer CLI — detailed tech stack
wappalyzer https://target.com
# httpx with tech detection built-in
cat alive_subs.txt | httpx -silent -tech-detect -o tech_detected.txt
# Extract unique technologies
cat tech_detected.txt | awk -F'[' '{print $2}' | tr -d ']' | tr ',' '\n' \
| sort | uniq -c | sort -rn
# Full pipeline: subdomains → alive → screenshot → filter → prioritize
cat all_subs.txt \
| httpx -silent -mc 200 -o alive_200.txt
gowitness file -f alive_200.txt -P ./screenshots/ --no-http
# Generate report for manual review
gowitness report generate --db gowitness.db -o ./report/
# Extract login/admin pages for priority testing
gowitness report list --db gowitness.db \
| grep -iE "login|admin|sign.?in|dashboard|panel|manage" \
> priority_targets.txt
--timeout 15 is usually sufficient; increase for slow connections.alive_subs.txt.subdomain-enumeration — Generate the list of alive subdomains.web-enumeration — Deep dive into individual hosts found via screenshots.cms-detection — Automated CMS and framework detection on discovered hosts.