菜单
Comprehensive reconnaissance — passive OSINT, subdomain enumeration, port scanning, technology fingerprinting
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
API security testing — REST, GraphQL, authentication, authorization, rate limiting, business logic
Network penetration testing — service enumeration, vulnerability scanning, credential auditing, Active Directory
Master pentest orchestration — full pipeline from target to report with confirmation gates
Generate professional penetration testing reports from findings
Web application penetration testing — XSS, SQLi, CSRF, SSRF, command injection, file upload, WAF bypass
Code security testing — SAST, SCA, secret detection, container scanning, IaC analysis
| name | pentest_recon |
| description | Comprehensive reconnaissance — passive OSINT, subdomain enumeration, port scanning, technology fingerprinting |
| triggers | ["recon","reconnaissance","enumerate","subdomain","port scan","fingerprint"] |
Perform comprehensive reconnaissance against a target.
Passive recon first (no direct contact):
whois {target}dig {target} ANY, dig {target} A MX TXT NS CNAME SOAsubfinder -d {target} -all -recursive -o /tmp/subdomains-subfinder.txtcurl -s "https://crt.sh/?q=%.{target}&output=json" | jq -r '.[].name_value' | sed 's/\*\.//g' | sort -u > /tmp/subdomains-crtsh.txtcat /tmp/subdomains-*.txt | sort -u > /tmp/subdomains-all.txtActive recon (after passive completes):
cat /tmp/subdomains-all.txt | httpx -silent -status-code -title -tech-detect -web-server -o /tmp/live-hosts.txtnmap -sV -sC -O --top-ports 1000 -T4 --open -oA /tmp/nmap-top {target}whatweb {target} -a 3 -v -o /tmp/whatweb.txtSummarize findings with counts for subdomains, live hosts, open ports, technologies.