name: recon
description: "Security reconnaissance for authorized targets. Map attack surface, discover assets, enumerate services."
triggers:
- recon
- reconnaissance
- bug bounty
- attack surface
- asset discovery

Recon Skill

Security reconnaissance for authorized targets. This skill provides a phased methodology for discovering and mapping the attack surface of web applications, APIs, and infrastructure. Every engagement MUST have explicit written authorization (bug bounty program scope, pentesting contract, or equivalent).

Phase Methodology

Phase 1: Passive Recon (No Target Interaction)

Gather intelligence without sending any traffic to the target.

Phase 2: Active Recon (Direct Target Interaction)

Send controlled traffic to discover live assets and services.

Phase 3: Vulnerability Mapping

Correlate discovered assets against known vulnerability patterns.

1. Automated scanning — Run nuclei against live hosts: nuclei -l live.txt -t cves/ -t exposures/ -o vulns.txt
2. Technology-specific checks — Match identified technologies (from httpx/Wappalyzer) against CVE databases
3. Configuration review — Check for exposed admin panels, default credentials, open redirects, CORS misconfigurations
4. SSL/TLS analysis — testssl.sh target.com or sslyze target.com for certificate and cipher issues

Phase 4: Reporting

Compile all findings into a structured report with evidence and risk ratings.

Scope Rules

• ONLY test assets explicitly listed in the authorization scope
• Respect rate limits and do not cause denial of service
• Do NOT access, modify, or exfiltrate user data
• Stop and report immediately if you encounter sensitive PII or credentials
• Log all tools and commands executed for audit trail

Output Format

## Recon Report: {Target}

### Metadata
- Target scope: {domains, IPs, or CIDR ranges}
- Authorization: {bug bounty program URL or engagement reference}
- Date: {YYYY-MM-DD}
- Phases completed: {1-4}

### Asset Inventory

| Asset | Type | Status | Technologies | Notes |
|-------|------|--------|--------------|-------|
| app.target.com | Web App | Live (200) | React, Nginx, Node.js | Main application |
| api.target.com | API | Live (200) | Express, PostgreSQL | REST API |
| admin.target.com | Admin Panel | Live (403) | Django | Requires auth |

### Open Ports & Services

| Host | Port | Service | Version | Notes |
|------|------|---------|---------|-------|
| target.com | 443 | HTTPS | Nginx 1.25 | TLS 1.3 |
| target.com | 22 | SSH | OpenSSH 9.0 | Key-only auth |

### Vulnerability Findings

| # | Finding | Severity | Asset | Evidence |
|---|---------|----------|-------|----------|
| 1 | {description} | {Critical/High/Med/Low} | {asset} | {proof} |

### Recommendations
1. {Actionable recommendation with priority}

Example Recon Workflow

Engagement: Bug bounty for example.com (scope: *.example.com).

1. Run subfinder -d example.com -silent -- found 47 subdomains
2. Probe with httpx -l subs.txt -sc -title -- 12 live hosts
3. Scan interesting hosts with nmap -sV -p 80,443,8080,8443
4. Content discovery with ffuf on main app and API endpoints
5. Run nuclei -l live.txt -severity critical,high -- found 2 high-severity issues
6. Compile report with asset inventory, port table, and vulnerability details
7. Submit findings through the bug bounty platform

When to Use

• Authorized bug bounty engagements with defined scope
• Penetration testing with a signed statement of work
• Internal security assessments of your own infrastructure

When NOT to Use

• No written authorization exists
• Target is out of scope or belongs to a third party
• You are unsure whether testing is permitted -- ask first