recon-phase
Skill884 starsChanged 4 months agoMITView on GitHub
Reconnaissance phase — passive OSINT then active enumeration. Use when the current phase is RECON. Triggers - OSINT, subdomain, whois, certificate transparency, shodan, google dork, footprint.
- Reads credentials
Files
Reconnaissance — Passive FIRST, then Active
Rule: exhaust PASSIVE before touching the target. Passive leaves no logs on target infra; active does.
Passive
- DNS/subdomains:
subfinder -d target.com -silent,amass enum -passive -d target.com,assetfinder --subs-only target.com - Cert transparency:
curl -s "https://crt.sh/?q=%25.target.com&output=json" | jq -r '.[].name_value' | sort -u— often finds forgotten subdomains + internal hostnames in CN fields - WHOIS/RDAP: registrar, name servers, historical contacts (who.is, rdap.org)
- Net blocks:
whois -h whois.radb.net -- '-i origin ASXXXX'→ prefix list, then validate withasnmap - Shodan/Censys: exposed services, banners, SSL certs (Shodan cert search pivots to sibling hosts on same org), leaked
.env/.gitindexes - Google dorks:
site:target.com filetype:xlsx,site:target.com inurl:admin,intitle:"index of" site:target.com,site:target.com ext:env | ext:sql | ext:bak - Code leaks: GitHub/GitLab search
org:target,target.com password, secret scanning (trufflehog/gitleaks on found repos) - Social: LinkedIn (org chart, tech stack, employees for phishing/spray), job ads (tech in use), Wayback Machine for dead endpoints still live internally
Active (in-scope domains/IPs ONLY)
- DNS brute + zone transfer:
dig axfr target.com @NS,gobuster dns -d target.com -w wordlist - Fingerprint:
httpx -l subs.txt -status-code -title -tech-detect -favicon-hash— favicon hash pivots toShodan http.favicon.hash:<mmh3> - ASN/IP expansion: resolve all found hosts → new IPs → re-check every IP against scope with
scope_check - WAF detect:
wafw00f https://target.com— affects scan tuning later
Gotchas
- Subdomain takeover check immediately: dangling CNAME (npm/github/azure/s3) →
subjack/nuclei -t takeovers/. It's recon AND a finding. - A cert in CT logs is NOT proof the host is in scope. Validate +
scope_checkbefore any active probe. - Record everything into the engagement state (
state_update): hosts, domains, org relationships. Later phases consume this — a host found in recon but never scanned is the classic miss. - Diff CT logs against live DNS: dead names may still resolve on INTERNAL resolvers (VPN/recon from inside).
In this repository31 other files it gives its agents.
- AGENTS.mdAGENTS.md
- CLAUDE.mdCLAUDE.md
- enumeration-phaseSkill
- exploitation-phaseSkill
- post-exploit-phaseSkill
- reporting-phaseSkill
- vuln-assess-phaseSkill
- playbook-adSkill
- playbook-apiSkill
- playbook-cloudSkill
- playbook-methodologySkill
- playbook-social-engineeringSkill
- playbook-webappSkill
- svc-cicdSkill
- svc-databaseSkill
- svc-docker-k8sSkill
- svc-ftpSkill
- svc-mobile-androidSkill
- svc-mobile-iosSkill
- svc-pivotingSkill
- svc-smbSkill
- svc-sshSkill
- svc-web-serverSkill
- web-auth-bypass-idorSkill
- web-deserializationSkill
- web-lfi-traversalSkill
- web-sqliSkill
- web-ssrfSkill
- web-sstiSkill
- web-upload-rceSkill
- web-xxeSkill
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
Reviews can't be read right now.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.