Menu
Enumerate web technologies, headers, endpoints, and metadata from a target
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Baseado na classificação ocupacional SOC
| name | web-recon |
| description | Enumerate web technologies, headers, endpoints, and metadata from a target |
| origin | RedteamOpencode |
run_tool curl, run_tool whatweb, openssl, grep/sed/jq
run_tool curl -sI -L https://TARGET
run_tool curl -sI https://TARGET | grep -iE "^(server|x-powered-by|x-aspnet|x-frame|content-security|strict-transport|set-cookie|www-authenticate)"
run_tool curl -sI -X OPTIONS https://TARGET
Note: Server, X-Powered-By, Set-Cookie flags, CSP, missing security headers.
run_tool whatweb -a 3 https://TARGET
run_tool curl -sL https://TARGET | grep -iE "generator|powered.by|built.with"
run_tool curl -sL https://TARGET | grep -i '<meta' | head -20
# WordPress
run_tool curl -s https://TARGET/wp-login.php -o /dev/null -w "%{http_code}"
run_tool curl -s https://TARGET/wp-json/wp/v2/users
# Joomla
run_tool curl -s https://TARGET/administrator/ -o /dev/null -w "%{http_code}"
# Drupal
run_tool curl -s https://TARGET/CHANGELOG.txt | head -5
# Generic
run_tool curl -s https://TARGET/readme.html -o /dev/null -w "%{http_code}"
echo | openssl s_client -connect TARGET:443 -servername TARGET 2>/dev/null | openssl x509 -noout -text | grep -E "Subject:|Issuer:|Not Before|Not After|DNS:"
for proto in tls1 tls1_1 tls1_2 tls1_3; do
echo | openssl s_client -connect TARGET:443 -$proto 2>/dev/null | grep -q "Protocol" && echo "$proto: supported"
done
run_tool curl -s https://TARGET/robots.txt
run_tool curl -s https://TARGET/sitemap.xml | head -50
run_tool curl -s https://TARGET/.well-known/security.txt
for path in crossdomain.xml clientaccesspolicy.xml humans.txt .well-known/openid-configuration; do
code=$(run_tool curl -s -o /dev/null -w "%{http_code}" "https://TARGET/$path")
[ "$code" != "404" ] && echo "$path -> $code"
done
run_tool curl -sL https://TARGET | grep -oE 'src="[^"]*\.js"' | sed 's/src="//;s/"//'
# Quick grep for API paths and secrets in each JS file
Only queue endpoints that are directly requestable and evidenced by a real response or real HTML/form/link extraction. Directory stems, SPA routes, and guessed names should stay as follow-up notes or surface candidates, not queue inputs.
run_tool curl -sL https://TARGET | grep -oE '<!--.*?-->' # Comments
run_tool curl -sL https://TARGET | grep -oiE '[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}' # Emails
run_tool curl -sL https://TARGET | grep -i 'type="hidden"' # Hidden fields
run_tool curl -sL https://TARGET | grep -oE 'href="[^"]*"' | sed 's/href="//;s/"//' | sort -u # Links
Business logic vulnerability detection — workflow bypass, price manipulation, state abuse, and application-specific flaws
Detect PII, credentials, and corporate sensitive data in API responses, source code, files, headers, and database extracts
Detect and exploit SQL injection vulnerabilities in web application parameters
Test for authentication and authorization flaws including credential attacks, session issues, and access control bypasses
Detect and exploit cross-site scripting vulnerabilities in web applications
Discover hidden parameters, test values, and identify input handling anomalies