SKILL.md
Recon & Surface Analysis
Use When
- The owner phase is target modeling, endpoint discovery, service enumeration, technology fingerprinting, vhost discovery, subdomain enumeration, or control-plane mapping.
- The next step needs a deduplicated inventory and prioritized validation targets.
Handoff Criteria
- Hand off to
pentest-web-enumerationwhen live HTTP(S) services need application fingerprinting, vhost discovery, route/JS/API enumeration, focused content discovery, or Nuclei-led early checks. - Hand off to mapper, authz, input/protocol, XSS, business-logic, OOB, CVE, exploit, or reporting workflows when the main blocker becomes focused validation or delivery.
Output Schema
- Surface inventory:
asset,interface,auth state,confidence - Entry-point matrix:
input,trust boundary,initial risk hypothesis - Prioritized next tests: ordered by likely impact and test cost
Instructions
- Build an explicit target model first: interfaces, trust boundaries, and identity contexts.
- Enumerate only what is necessary to expose actionable attack paths.
- Normalize findings into a deduplicated inventory before deeper testing.
- Label each surface with attacker preconditions and probable abuse class.
- Mark unknowns that block progression and propose the minimum test to resolve each.
- Hand off precise, testable targets to downstream skills.
Should Do
- Keep reconnaissance hypothesis-driven, not tool-driven.
- Capture reproducible evidence for each discovered surface.
- Prioritize externally reachable and privilege-sensitive paths.
- Use up to two controlled pivots per phase; each pivot needs an expected signal and stop condition.
- Treat scanner output as a lead until cross-checked with direct evidence.
Tip: Fuzzing for Virtual Hosts with FFUF
Discover assets not listed in DNS by testing different Host header values. FFUF is the ideal tool for this speed-efficient enumeration.
Quick Guide
- Optimize: Use small wordlists and fast scans to ensure the agent doesn't get stuck.
- Execute:
ffuf -u $TARGET -H "Host: FUZZ.$TARGET" -w /path/to/small_wordlist - Filter: Identify live hosts by filtering unique response sizes or status codes (e.g.,
-fs [size]or-mc 200).