Agent skill · security · aiskillstore
reconnaissance-knowledge
Comprehensive knowledge about network reconnaissance and service enumeration. Provides methodologies for port scanning, service fingerprinting, web directory discovery, and vulnerability identification. Includes best practices for structured data collection.
Why this skill is useful
Provides detailed methodologies and specific command examples for network reconnaissance that the AI wouldn't reliably generate on its own.
What it needs
Requires curl, dig, dirb, enum4linux, gobuster, host, masscan, nikto, nmap, nslookup, showmount, smbclient, snmpwalk, wget installed locally. About 4k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Reconnaissance Knowledge Base Purpose This knowledge base provides comprehensive reconnaissance methodologies and techniques. It covers information gathering about targets without performing exploitation, including discovering services, versions, technologies, and potential attack vectors. Tools Available Network Scanning nmap - Port and service discovery masscan - Fast port scanning (if speed needed) nc (netcat) - Banner grabbing Web Enumeration gobuster - Directory/file brute forcing dirb - Alternative directory scanner nikto - Web vulnerability scanner whatweb - Technology identification curl/wget - Manual HTTP interaction Service Enumeration enum4linux - SMB/Samba enumeration smbclient - SMB interaction showmount - NFS enumeration snmpwalk - SNMP enumeration DNS/Subdomain dig - DNS queries host - DNS lookups nslookup - DNS information Layered Reconnaissance Strategy Core Principle: Every reconnaissance task has 3 layers - escalate when previous layer yields insufficient results. Layer Framework for Each Task: Escalation Triggers: Layer 1 returns nothing → Escalate to Layer 2 Layer 2 returns minimal info → Escalate to Layer 3 Layer 3 still insufficient → Re-evaluate entire approach --- Reconnaissance Phases Phase 1: Port Discovery Goal: Find all open ports Output Format: Phase 2: Service Detection Goal: Identify services and versions Output Format: Phase 3: Web Enumeration (if HTTP/HTTPS found) Goal: Discover hidden files, directories, and web technologies Layered Web Scanning: Output Format: Phase 4: Specific Service Enumeration SMB (Port 139/445) FTP (Port 21) SSH (Port 22) MySQL/MSSQL (Port 3306/1433) Best Practices 1. Structured Output Always format discoveries in JSON for easy parsing: 2. Stealth vs Speed For playground environments: Use aggressive scans (-T4, --min-rate=1000) For real environments: Use slower, stealthy scans (-T2) 3. Save All Output 4. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/reconnaissance-knowledge