recon-pipeline

Recon Pipeline — Full Multi-Phase Reconnaissance

Orchestrate a complete security reconnaissance workflow across all available tools.

Decision Loop: In-the-Loop (full pipeline requires explicit authorization)

Safety — CRITICAL Authorization Required

Before starting the pipeline:

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
🔍 Recon Pipeline — Full Security Assessment
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

เป้าหมาย (Target): <target-domain>
เฟส (Phases): <1-3 or all>

เครื่องมือที่จะใช้ (Tools to be used):
  Phase 1 (Passive):  Shodan, Subfinder, WhatWeb (level 1)
  Phase 2 (Discovery): Nmap (standard mode)
  Phase 3 (Assessment): Nuclei (ncsa+high), Nikto, SQLMap (detect only, if forms found)

⚠️ Phase 2-3 จะส่ง traffic ไปยังเป้าหมาย (will send traffic to target)
⚠️ ต้องได้รับอนุญาตจากเจ้าของเป้าหมาย (authorization from target owner required)

ยืนยันดำเนินการ? (Confirm execution?) [y/N]

Do NOT proceed without explicit user confirmation.

Arguments

• <target-domain> — Primary domain to assess (REQUIRED)
• --phases — Which phases to run (default: all)
• --skip-sqlmap — Skip SQL injection testing

Pipeline Architecture

Phase 1: Passive Recon (no traffic to target)
├── Shodan API lookup (host info, known vulns)
├── Subfinder (subdomain enumeration)
└── WhatWeb level 1 (technology detection)
         │
         ▼ (discovered subdomains + IPs)
Phase 2: Discovery (active scanning)
├── httpx (live host verification)
└── Nmap standard scan (ports + services)
         │
         ▼ (live hosts + open ports + services)
Phase 3: Assessment (vulnerability scanning)
├── Nuclei (NCSA templates + critical/high)
├── Nikto (web server vulnerabilities)
└── SQLMap detect (if web forms found, optional)
         │
         ▼
Finding Analyst Agent
├── Deduplicate across tools
├── Map to OWASP / NCSA categories
├── Assign severity ratings
└── Generate combined report

Execution Steps

Phase 1: Passive Recon

Use the recon-orchestrator agent to coordinate: