recon

Q: How do I install recon?

Run npx skills add https://github.com/briiirussell/cybersecurity-skills --skill recon in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/recon/ (personal) or .claude/skills/recon/ (project).

by briiirussellTesting & QA

Perform structured reconnaissance and attack surface enumeration for authorized penetration tests, CTF challenges, and bug bounty programs. Use when the user mentions 'recon,' 'reconnaissance,' 'enumerate,' 'attack surface,' 'subdomain enumeration,' 'port scan,' 'fingerprint,' 'asset discovery,' or needs to map a target's external footprint.

Installs: 411
Last 24h: —
Trending rank: —
Security: Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/briiirussell/cybersecurity-skills --skill recon

01
Install
Run the command in your project. The CLI asks which agents to install for.
02
Describe the task
Ask your agent for something this skill covers. It loads recon automatically when relevant.
03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

Recon — Penetration Testing Reconnaissance

Perform structured reconnaissance against an authorized target, organizing findings into an actionable attack surface map.

Cross-references: osint-recon for the deeper open-source-intelligence pass (people, organizations, historical data) — this skill is the active/passive target-mapping side, osint-recon is the broader investigative side; they pair naturally. web-pentest for the next stage once recon has produced an attack surface map and an authorized target list. owasp-audit for source-code review when you have access to the target's code.

Authorization Check

Before running any commands, confirm:

The user has written authorization for the target (pentest engagement, bug bounty program, CTF/lab environment)
The target is within the defined scope

If authorization is unclear, ask before proceeding. Never assume authorization.

Methodology

Phase 1: Passive Recon

Gather information without touching the target directly.

DNS enumeration:

Run dig any $ARGUMENTS for A, AAAA, MX, TXT, NS, CNAME records
Attempt zone transfer: dig axfr @ns-server $ARGUMENTS

Enumerate subdomains via certificate transparency:

curl -s "https://crt.sh/?q=%25.$ARGUMENTS&output=json" | jq -r '.[].name_value' | sort -u

WHOIS and registration: Run whois $ARGUMENTS for registrant, nameserver, and creation date info.

Search engine dorking: Use targeted queries — site:, inurl:, filetype:, intitle: — to find exposed pages, documents, and admin panels.

Technology fingerprinting: Identify frameworks, CMS, server software, and JavaScript libraries from public-facing pages.

Public code repositories: Search GitHub/GitLab for the target's org name, domain, API keys, or internal paths.

Historical data: Check the Wayback Machine for old endpoints, removed pages, and configuration files.

Phase 2: Active Recon (explicit authorization only)

Port scanning:

nmap -sC -sV -oN scan-results.txt $ARGUMENTS

Start with top 1000 ports. Expand to full range (-p-) if needed. Use -Pn if the host appears down but is in scope.

Service enumeration: Based on open ports, probe for version info and default configurations.

Web content discovery:

Directory bruting with gobuster, feroxbuster, or dirsearch
Virtual host enumeration
API endpoint discovery (check /api/, /v1/, /graphql, /swagger.json)

SSL/TLS analysis: Run testssl.sh or sslyze to check for weak ciphers, expired certificates, and misconfigurations.

Phase 3: Analysis

Correlate all findings. Identify the most promising attack vectors and prioritize by:

Severity of potential impact
Likelihood of exploitation
Exposure level (internet-facing vs. internal)

Output Format

Produce a structured recon report:

# Recon Report
## Target: [target]
## Scope: [confirmed scope]
## Date: [date]

### Passive Findings
| Finding | Details | Relevance |
|---------|---------|-----------|

### Subdomains Discovered
- [list]

### Technologies Detected
- [list with versions where identified]

### Active Findings
| Port | Service | Version | Notes |
|------|---------|---------|-------|

### Attack Surface Summary
[Prioritized list of interesting findings with risk assessment]

### Recommended Next Steps
[Ordered list of what to investigate further]

Boundaries

Stay within the defined scope — never scan adjacent or out-of-scope systems
Rate-limit aggressive scans to avoid disruption
Log all commands run for the engagement record
If you discover evidence of active compromise by a third party, alert the user immediately
Refuse requests targeting systems without explicit authorization
Refuse requests for mass scanning of unrelated targets

References

PTES (Penetration Testing Execution Standard)
OWASP Testing Guide
Bug Bounty Methodology (jhaddix/tbhm)

FAQ

What does the recon skill do?

How do I install recon?

Run npx skills add https://github.com/briiirussell/cybersecurity-skills --skill recon in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/recon/ (personal) or .claude/skills/recon/ (project).

Which AI agents can use recon?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is recon safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains recon?

It is published by briiirussell in briiirussell/cybersecurity-skills. It has 411 recorded installs.