# Web Recon

> >

- **Type:** Skill
- **Install:** `agentstack add skill-douglasrao-claude-pentest-skills-web-recon`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [DouglasRao](https://agentstack.voostack.com/s/douglasrao)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [DouglasRao](https://github.com/DouglasRao)
- **Source:** https://github.com/DouglasRao/Claude-Pentest-Skills/tree/main/skills/web-recon

## Install

```sh
agentstack add skill-douglasrao-claude-pentest-skills-web-recon
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Web Recon — Offensive Kill Chain

## Architecture

The skill is divided into **3 bash scripts** with checkpoint/resume and real parallelism:

```
scripts/
├── common.sh           # Shared functions (logging, has_tool, phase_done, etc.)
├── recon_passive.sh    # PHASES 1 + 2 + 2.2 (subs, DNS, live, CMS)
├── recon_active.sh     # PHASES 3 + 4 + 5 (URLs, JS, content discovery)
└── recon_vuln.sh       # PHASES 6 + 7 + 8 (nuclei, open redirect, S3)
```

Each script:
- Accepts ` ` as args
- Uses checkpoints (`.phase_X.done`) — can be re-run without repeating completed phases
- Emits a JSON summary via `---RECON_SUMMARY_JSON---` markers for Claude to parse
- Executes subtasks in parallel internally (background jobs + wait)

---

## Tool Priority

### 1. CLI via Bash — always first
```
subfinder > assetfinder > findomain   (passive enumeration)
dnsx                                  (DNS resolution)
httpx (Go version)                    (live detection — NEVER Python httpx)
nuclei                                (vulnerability scan)
katana > hakrawler > waybackurls      (crawling / URL discovery)
feroxbuster > ffuf                    (content discovery)
wafw00f                               (WAF detection)
paramspider > arjun                   (parameter discovery)
```

### 2. Bundled scripts — executed automatically by phases
```
js_secret_scanner.py   → PHASE 4 (JS secret scanning)
wpscan_lite.py         → PHASE 2.2 (fallback if wpscan not installed)
joomscan.py            → PHASE 2.2 (Joomla scan)
```

### 3. Manual curl / wget — for one-off requests

### 4. MCPs — if available (Burp, Chrome, Postman, Notion)

### 5. Always verify tools before use
```bash
command -v  || echo "WARNING:  not found"
```
Never assume a tool is installed. Never install without explicit permission.

---

## Operational Rules

- **Never install tools** without explicit permission (brew, pip, npm, go install, apt, etc.)
- **Never delete files** without explicit permission
- **DNS Bruteforce**: optional — only with explicit `--bruteforce` flag or passive count  Always call `tabs_context_mcp` before any browser automation.

### Postman (`mcp__postman__*`)
Only if target exposes a REST/GraphQL API: import endpoints, IDOR/auth tests, document requests.

### Notion (`mcp__Notion__*`)
Publish final report and create subpages for each critical/high finding.

---

## Execution Modes

| Mode | When to use | What runs |
|------|-------------|-----------|
| `--quick` | Wide-scope bug bounty | Passive (no bruteforce) + nuclei |
| `--full` | Authorized pentest | All 3 blocks + report |
| `--js-only` | Specific target, frontend analysis | PHASE 4 of recon_active.sh only |
| `--passive` | OSINT without touching target | PHASE 1.1 + historical URLs only |

---

## Operational Notes

- **Checkpoint/resume**: If a script fails mid-run, re-running skips completed phases (`.phase_X.done`)
- **Token efficiency**: Scripts run everything via Bash and emit only JSON summary — do not read full tool output
- **Rate limiting**: In production bug bounty, reduce threads/rate-limit to avoid triggering alerts
- **WAF bypass via Host header**: `httpx -l ips.txt -H "Host: target.com" -status-code -path /`
- **Proxy through Burp**: `cat $OUT/dns/urls.txt | httpx -silent -proxy http://127.0.0.1:8080`

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [DouglasRao](https://github.com/DouglasRao)
- **Source:** [DouglasRao/Claude-Pentest-Skills](https://github.com/DouglasRao/Claude-Pentest-Skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-douglasrao-claude-pentest-skills-web-recon
- Seller: https://agentstack.voostack.com/s/douglasrao
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.