Scraping et collectesource GitHub
/recon
/reconLancez le pipeline de reconnaissance complet sur une cible et produisez une surface d’attaque priorisée.
// contenu du skill
name: recon
description: Run full recon pipeline on a target — subdomain enum (Chaos API + subfinder), live host discovery (dnsx + httpx), URL crawl (katana + waybackurls + gau), gf pattern classification, nuclei scan. Outputs to recon/<target>/ directory. Usage: /recon target.com
/recon
Run the full recon pipeline on a target and produce a prioritized attack surface.
What This Does
- Enumerates subdomains (Chaos API + subfinder + assetfinder)
- Resolves DNS and finds live hosts (dnsx + httpx with status/title/tech)
- Crawls URLs (katana deep crawl + waybackurls + gau historical)
- Classifies URLs by bug class (gf patterns)
- Runs nuclei for known CVEs and misconfigs
- Outputs prioritized attack surface summary
Usage
/recon target.comOr with specific focus:
/recon target.com --focus api
/recon target.com --focus auth
/recon target.com --fast (skip historical URLs)Steps
Step 1: Subdomain Enumeration
bash
TARGET="$1"
mkdir -p recon/$TARGET
# Chaos API (ProjectDiscovery — most comprehensive)
curl -s "https://dns.projectdiscovery.io/dns/$TARGET/subdomains" \
-H "Authorization: $CHAOS_API_KEY" \
| jq -r '.[]' > recon/$TARGET/subdomains.txt
# subfinder + assetfinder
subfinder -d $TARGET -silent | anew recon/$TARGET/subdomains.txt
assetfinder --subs-only $TARGET | anew recon/$TARGET/subdomains.txt
echo "[+] Subdomains: $(wc -l < recon/$TARGET/subdomains.txt)"Step 2: Live Host Discovery
bash
# DNS resolve + HTTP probe with tech detection
cat recon/$TARGET/subdomains.txt \
| dnsx -silent \
| httpx -silent -status-code -title -tech-detect \
| tee recon/$TARGET/live-hosts.txt
echo "[+] Live hosts: $(wc -l < recon/$TARGET/live-hosts.txt)"Step 3: URL Crawl
bash
# Active crawl
cat recon/$TARGET/live-hosts.txt | awk '{print $1}' \
| katana -d 3 -jc -kf all -silent \
| anew recon/$TARGET/urls.txt
# Historical URLs
echo $TARGET | waybackurls | anew recon/$TARGET/urls.txt
gau $TARGET --subs | anew recon/$TARGET/urls.txt
echo "[+] Total URLs: $(wc -l < recon/$TARGET/urls.txt)"Step 4: Classify URLs
bash
# Bug class classification — gf patterns
cat recon/$TARGET/urls.txt | gf xss > recon/$TARGET/xss-candidates.txt
cat recon/$TARGET/urls.txt | gf ssrf > recon/$TARGET/ssrf-candidates.txt
cat recon/$TARGET/urls.txt | gf idor > recon/$TARGET/idor-candidates.txt
cat recon/$TARGET/urls.txt | gf sqli > recon/$TARGET/sqli-candidates.txt
cat recon/$TARGET/urls.txt | gf redirect > recon/$TARGET/redirect-candidates.txt
cat recon/$TARGET/urls.txt | gf lfi > recon/$TARGET/lfi-candidates.txt
cat recon/$TARGET/urls.txt | gf rce > recon/$TARGET/rce-candidates.txt
cat recon/$TARGET/urls.txt | gf ssti > recon/$TARGET/ssti-candidates.txt
cat recon/$TARGET/urls.txt | gf interestingparams > recon/$TARGET/interesting-candidates.txt
# Open redirect params (extra patterns not in gf)
grep -E "(\?|&)(redirect|next|return|dest|destination|go|forward|target|redir|url|continue|returnTo|returnUrl|callback|out|link)=" \
recon/$TARGET/urls.txt | anew recon/$TARGET/redirect-candidates.txt
# CORS check candidates
grep -E "(\?|&)(callback|jsonp|cb|_callback)=" recon/$TARGET/urls.txt \
> recon/$TARGET/cors-jsonp-candidates.txt
# Host header / password reset candidates
cat recon/$TARGET/urls.txt | grep -E "/(forgot|reset|password|recovery)" \
> recon/$TARGET/host-header-candidates.txt
# File upload candidates
cat recon/$TARGET/urls.txt | grep -E "/(upload|import|attach|file|document|image|avatar|profile)" \
> recon/$TARGET/upload-candidates.txt
# API endpoints
cat recon/$TARGET/urls.txt | grep -E "/api/|/v1/|/v2/|/v3/|/graphql|/rest/|/gql" \
> recon/$TARGET/api-endpoints.txt
# Auth/session endpoints
cat recon/$TARGET/urls.txt | grep -E "/(login|logout|signin|signup|register|auth|oauth|sso|token|session)" \
> recon/$TARGET/auth-endpoints.txt
# Admin panels
cat recon/$TARGET/live-hosts.txt | awk '{print $1}' | while read host; do
for path in /admin /admin/ /dashboard /wp-admin /jenkins /grafana /kibana /phpmyadmin /adminer; do
STATUS=$(curl -s -o /dev/null -w "%{http_code}" --max-time 5 "$host$path")
[ "$STATUS" != "404" ] && [ "$STATUS" != "000" ] && echo "$STATUS $host$path"
done
done > recon/$TARGET/admin-panels.txt
echo "[+] IDOR candidates: $(wc -l < recon/$TARGET/idor-candidates.txt)"
echo "[+] SSRF candidates: $(wc -l < recon/$TARGET/ssrf-candidates.txt)"
echo "[+] LFI candidates: $(wc -l < recon/$TARGET/lfi-candidates.txt)"
echo "[+] Redirect candidates:$(wc -l < recon/$TARGET/redirect-candidates.txt)"
echo "[+] Upload candidates: $(wc -l < recon/$TARGET/upload-candidates.txt)"
echo "[+] API endpoints: $(wc -l < recon/$TARGET/api-endpoints.txt)"
echo "[+] Auth endpoints: $(wc -l < recon/$TARGET/auth-endpoints.txt)"
echo "[+] Admin panels found: $(wc -l < recon/$TARGET/admin-panels.txt)"Step 5: Nuclei Scan
bash
# Full severity scan
// source originale publique
elementalsouls/Claude-BugHunter/commands/recon.md
Licence : Other. Consultez le dépôt avant toute réutilisation.
Projet indépendant, non affilié à Anthropic. Ce skill reste la propriété de son auteur original.
