Web Recon

Web Recon — Offensive Kill Chain

Architecture

The skill is divided into 3 bash scripts with checkpoint/resume and real parallelism:

scripts/
├── common.sh           # Shared functions (logging, has_tool, phase_done, etc.)
├── recon_passive.sh    # PHASES 1 + 2 + 2.2 (subs, DNS, live, CMS)
├── recon_active.sh     # PHASES 3 + 4 + 5 (URLs, JS, content discovery)
└── recon_vuln.sh       # PHASES 6 + 7 + 8 (nuclei, open redirect, S3)

Each script:

• Accepts as args
• Uses checkpoints (.phase_X.done) — can be re-run without repeating completed phases
• Emits a JSON summary via ---RECON_SUMMARY_JSON--- markers for Claude to parse
• Executes subtasks in parallel internally (background jobs + wait)

---

Tool Priority

1. CLI via Bash — always first

subfinder > assetfinder > findomain   (passive enumeration)
dnsx                                  (DNS resolution)
httpx (Go version)                    (live detection — NEVER Python httpx)
nuclei                                (vulnerability scan)
katana > hakrawler > waybackurls      (crawling / URL discovery)
feroxbuster > ffuf                    (content discovery)
wafw00f                               (WAF detection)
paramspider > arjun                   (parameter discovery)

2. Bundled scripts — executed automatically by phases

js_secret_scanner.py   → PHASE 4 (JS secret scanning)
wpscan_lite.py         → PHASE 2.2 (fallback if wpscan not installed)
joomscan.py            → PHASE 2.2 (Joomla scan)

3. Manual curl / wget — for one-off requests

4. MCPs — if available (Burp, Chrome, Postman, Notion)

5. Always verify tools before use

command -v  || echo "WARNING:  not found"

Never assume a tool is installed. Never install without explicit permission.

---

Operational Rules

• Never install tools without explicit permission (brew, pip, npm, go install, apt, etc.)
• Never delete files without explicit permission
• DNS Bruteforce: optional — only with explicit --bruteforce flag or passive count Always call tabs_context_mcp before any browser automation.

Postman (mcp__postman__*)

Only if target exposes a REST/GraphQL API: import endpoints, IDOR/auth tests, document requests.

Notion (mcp__Notion__*)

Publish final report and create subpages for each critical/high finding.

---

Execution Modes

| Mode | When to use | What runs | |------|-------------|-----------| | --quick | Wide-scope bug bounty | Passive (no bruteforce) + nuclei | | --full | Authorized pentest | All 3 blocks + report | | --js-only | Specific target, frontend analysis | PHASE 4 of recon_active.sh only | | --passive | OSINT without touching target | PHASE 1.1 + historical URLs only |

---

Operational Notes

• Checkpoint/resume: If a script fails mid-run, re-running skips completed phases (.phase_X.done)
• Token efficiency: Scripts run everything via Bash and emit only JSON summary — do not read full tool output
• Rate limiting: In production bug bounty, reduce threads/rate-limit to avoid triggering alerts
• WAF bypass via Host header: httpx -l ips.txt -H "Host: target.com" -status-code -path /
• Proxy through Burp: cat $OUT/dns/urls.txt | httpx -silent -proxy http://127.0.0.1:8080

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: DouglasRao
• Source: DouglasRao/Claude-Pentest-Skills
• License: MIT

Install and usage instructions live in the source repository linked above.