Agent skill · security · yaklang
recon-and-methodology
Reconnaissance and methodology playbook. Use when mapping assets, discovering endpoints, fingerprinting technology, and building a structured testing plan for a new target.
Why this skill is useful
Adds numerous executable scripts for reconnaissance and vulnerability testing that are not commonly found in public documentation.
What it needs
Requires amass, arjun, curl, dnsx, ffuf, gau, gobuster, httpx, jq, linkfinder, masscan, massdns, nmap, subfinder, wappalyzer, whatweb, x8 installed locally. About 6k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Recon and Methodology — Expert Bug Bounty Playbook AI LOAD INSTRUCTION: Systematic recon and bug-finding methodology from top bug hunters. Covers subdomain enumeration, endpoint discovery, tech fingerprinting, and the hunter's mental model for finding bugs that others miss. Key insight: most high-severity bugs are found through systematic coverage, not just clever payloads. --- 1. RECON HIERARCHY --- 2. SUBDOMAIN ENUMERATION (CRITICAL FIRST STEP) Passive (no DNS queries to target) Active (DNS brute force + resolution) Virtual Host Discovery --- 3. SERVICE AND PORT DISCOVERY --- 4. WEB TECHNOLOGY FINGERPRINTING --- 5. ENDPOINT DISCOVERY Directory Brute Force Parameter Discovery JavaScript Source Mining API Endpoint Discovery --- 6. SOURCE CODE RECON GitHub / GitLab Exposure Exposed Environment Files --- 7. ZSEANO'S TESTING METHODOLOGY Core Philosophy 1. Go deep on one program rather than spread across many — learn the application thoroughly 2. Build a profile of the company — tech stack, developers, processes 3. Look where others don't — check error pages, admin paths, old versions, mobile API 4. Follow the filter — if input is filtered somewhere, that functionality exists and may be bypassed Testing Sequence (One Page / Feature) Parameter Insights --- 8. BUG BOUNTY PROGRAM TRIAGE (WHERE TO SPEND TIME) High-Value Target Selection High-Value Feature Focus (by bug probability) --- 9. NUCLEI TEMPLATES (AUTOMATED SCANNING) --- 10. COMMON MISCONFIGURATIONS (QUICK WINS) --- 11. QUICK REFERENCE TOOLS Category Tool --- --- Subdomain enum subfinder, amass, massdns Port scan nmap, masscan HTTP probe httpx Dir brute ffuf, feroxbuster, gobuster JS mining LinkFinder, gau, waybackurls Secret scan trufflehog, gitleaks Parameter fuzz arjun, x8 Vuln scan nuclei Proxy/intercept Burp Suite Pro JWT attacks jwttool SQLi sqlmap XSS dalfox, XSStrike SSRF SSRFmap, Gopherus --- 12. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/recon-and-methodology