A collection of scripts for authorized web security reconnaissance, meaning mapping a website’s publicly visible attack surface before testing it. It covers finding subdomains, resolving DNS, identifying live services, discovering URLs and content, and scanning for selected weaknesses.

Use it for permitted bug-bounty or penetration-testing preparation, including subdomain discovery, live-host checks, URL and JavaScript collection, content discovery, and vulnerability scans.

It organizes many reconnaissance steps into resumable phases instead of requiring each command to be run and tracked manually. Checkpoints and parallel tasks help preserve progress across a longer assessment.

web-recon — Skill for Claude Code by DouglasRao

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add DouglasRao/Claude-Pentest-Skills --skill web-recon

Clone the repo

git clone --depth 1 https://github.com/DouglasRao/Claude-Pentest-Skills

Made for: Claude Code.

Or install claude-pentest-skills, the plugin that ships this one along with the rest of its 8 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/douglasrao/claude-pentest-skills/web-recon/github.svg)](https://agentmods.dev/skills/douglasrao/claude-pentest-skills/web-recon)

Your own site

<a href="https://agentmods.dev/skills/douglasrao/claude-pentest-skills/web-recon"><img src="https://agentmods.dev/badge/skills/douglasrao/claude-pentest-skills/web-recon/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/douglasrao/claude-pentest-skills/web-recon"><img src="https://agentmods.dev/badge/skills/douglasrao/claude-pentest-skills/web-recon.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 120 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,525 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00120	$0.02525
Opus 5	$0.00060	$0.01262
Sonnet 5	$0.00024	$0.00505
Haiku 4.5	$0.00012	$0.00252

Measured 12d ago against content hash 42e12aac9a07, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

web-recon scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.

The scan reads SKILL.md. This mod also ships 7 executable files (scripts/common.sh, scripts/joomscan.py, scripts/js_secret_scanner.py, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

### 3. Manual curl / wget — for one-off requests

skills/web-recon/SKILL.md · 269 lines

How it starts

The opening of the file, as written. The whole thing — 269 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Web Recon — Offensive Kill Chain

Architecture

The skill is divided into 3 bash scripts with checkpoint/resume and real parallelism:

scripts/
├── common.sh           # Shared functions (logging, has_tool, phase_done, etc.)
├── recon_passive.sh    # PHASES 1 + 2 + 2.2 (subs, DNS, live, CMS)
├── recon_active.sh     # PHASES 3 + 4 + 5 (URLs, JS, content discovery)
└── recon_vuln.sh       # PHASES 6 + 7 + 8 (nuclei, open redirect, S3)

Each script:

Accepts <domain> <output_dir> as args
Uses checkpoints (.phase_X.done) — can be re-run without repeating completed phases
Emits a JSON summary via ---RECON_SUMMARY_JSON--- markers for Claude to parse
Executes subtasks in parallel internally (background jobs + wait)

Tool Priority

1. CLI via Bash — always first

subfinder > assetfinder > findomain   (passive enumeration)
dnsx                                  (DNS resolution)
httpx (Go version)                    (live detection — NEVER Python httpx)
nuclei                                (vulnerability scan)
katana > hakrawler > waybackurls      (crawling / URL discovery)
feroxbuster > ffuf                    (content discovery)
wafw00f                               (WAF detection)
paramspider > arjun                   (parameter discovery)

2. Bundled scripts — executed automatically by phases

js_secret_scanner.py   → PHASE 4 (JS secret scanning)
wpscan_lite.py         → PHASE 2.2 (fallback if wpscan not installed)
joomscan.py            → PHASE 2.2 (Joomla scan)

3. Manual curl / wget — for one-off requests

4. MCPs — if available (Burp, Chrome, Postman, Notion)

5. Always verify tools before use

command -v <tool> || echo "WARNING: <tool> not found"

Never assume a tool is installed. Never install without explicit permission.

Operational Rules

Never install tools without explicit permission (brew, pip, npm, go install, apt, etc.)
Never delete files without explicit permission
DNS Bruteforce: optional — only with explicit --bruteforce flag or passive count < 20 subs
SecLists wordlists: always use the smallest available (small → common → medium)
httpx: scripts enforce Go version via ensure_httpx_go() in common.sh

Read the full file on GitHub · 269 lines

Files

What ships with it

7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

12d ago First seen · 269 lines · 120 tokens per session scan A 42e12aac9a07

Subscribe to this mod's changes

web-recon is a skill published in the GitHub repository DouglasRao/Claude-Pentest-Skills (11 stars, last pushed 5mo ago), licensed MIT. It adds 120 tokens to every session and 2,525 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Claude Code Security active-directory ai bug-bounty cms-scan cybersecurity hacking nuclei osint recon subdomain-enumeration web-pentest

auditing-azure-active-directory-configuration

Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly permissive role assignments, stale accounts, conditional access gaps, and guest user risks using AzureAD PowerShell, Microsoft Graph API, and ScoutSuite.

xalgorix/xalgorix · 58 tokens

deploying-active-directory-honeytokens

Deploys deception-based honeytokens in Active Directory including fake privileged accounts with AdminCount=1, fake SPNs for Kerberoasting detection (honeyroasting), decoy GPOs with cpassword traps, and fake BloodHound paths. Monitors Windows Security Event IDs 4769, 4625, 4662, 5136 for honeytoken interaction. Use…

xalgorix/xalgorix · 101 tokens

github-secret-hunting

Find leaked API keys, tokens, and credentials in public GitHub repositories.

uphiago/recon-skills · 20 tokens

metabigor

Use when operating the metabigor CLI for OSINT recon and infrastructure mapping without API keys. Covers finding network ranges from an ASN, org, domain, or IP (net); enumerating subdomains from certificate logs (cert); enriching IPs with ports/CVEs via Shodan InternetDB (ip); searching public GitHub code for secrets…

j3ssie/metabigor · 143 tokens

osint-methodology

Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments. Covers the 5-stage recon pipeline (seed discovery, asset expansion, enrichment, exposure analysis, reporting), asset-graph discipline with 29 asset types, severity rubric (CRITICAL/HIGH/MEDIUM/LOW/INFO)…

uphiago/recon-skills · 258 tokens

conducting-external-reconnaissance-with-osint

Conducts external reconnaissance using Open Source Intelligence (OSINT) techniques to map an organization's external attack surface without directly interacting with target systems. The tester gathers information from public sources including DNS records, certificate transparency logs, search engines, social media…

26zl/cybersec-toolkit · 96 tokens

web-recon