/recon-asset-discovery

name: recon-asset-discovery
description: "Subdomain enumeration, CT logs, DNS record catalog, WHOIS/RDAP, and passive reconnaissance for authorized external recon."
when_to_use: "Use for passive external asset discovery: subdomain enumeration, certificate-transparency (crt.sh) lookups, DNS record cataloging, and WHOIS/RDAP queries during footprinting."

Recon — Asset Discovery

> Sub-skill of `offensive-osint`. Load `osint-methodology` for pipeline and triage context. > Authorized targets only.

---

BEHAVIORAL CONTRACT

**When triggered:** Subdomain enumeration, asset discovery, DNS records, CT logs, WHOIS/RDAP, or passive reconnaissance is needed.

**Execute:**

1. Run the passive subdomain-source stack (§1) in parallel across all listed sources. If crt.sh is down, follow the fallback chain. 2. Complement passive results with common-prefix candidates from the prefix wordlist (§2). 3. Run WHOIS/RDAP (§3) on the root domain. Extract registrant org/email for pivoting. 4. Catalog DNS records (§4) for every discovered domain/subdomain. Parse TXT records for SaaS tenancy inference using the verification token table. 5. Check autodiscover for M365 confirmation (§4). 6. Deduplicate all discovered assets by typed key. Tag each with confidence level per `osint-methodology` §2.

**Output:** Asset list with typed keys (subdomain, ip, domain) per `osint-methodology` §8 taxonomy.

**Severity rules:** DNS AXFR success = CRITICAL. Missing CAA = LOW.

**Gating rules:** Passive first. Active prefix sweep only when authorized. Brute-force (puredns) only with explicit operator approval.

**Chain to:** Feed discovered subdomains to `web-surface` for probing. Feed discovered emails to `people-breach-intel` for breach lookup. Feed discovered IPs to `cloud-and-infra` for infrastructure analysis.

---

1. Subdomain-Source Stack (Passive)

| Source | Tier | Notes | | -------------- | --------------- | ------------------------------------------------------------ | | crt.sh | Free | Best single source; **frequently 502s — see fallback chain** | | VirusTotal | Freemium | Domain → passive DNS history | | AlienVault OTX | Free | Passive DNS + URL data | | Shodan | Paid (low tier) | Subdomain enum via `domain:` filter | | SecurityTrails | Paid | Passive DNS + asset discovery | | RapidDNS | Free | Public passive DNS | | Subfinder | Free | Aggregates 30+ free sources | | Amass | Free | Thorough, slower | | Recon-ng | Free | Modular framework |

**DNS AXFR opportunism:**

dig @<ns-host> <target-domain> AXFR

Most NSs reject; those that don't = full zone disclosure (CRITICAL).

**Brute-force tier:** puredns against [assetnote.io](https://wordlists.assetnote.io/) wordlists.

1.1 crt.sh Down? Fallback Chain

D="target.example"

# 1. Censys cert search (free 250 queries/month with key)
censys search "names: ${D}" --index-type certificates --fields names | jq -r '.names[]' | sort -u

# 2. Cert Spotter API (sslmate) — free w/ rate limits
curl -sk "https://api.certspotter.com/v1/issuances?domain=${D}&include_subdomains=true&expand=dns_names" | \
  jq -r '.[].dns_names[]' | sort -u

# 3. CertStream archive (Calidog)
curl -sk "https://crt.calidog.io/?q=${D}" | jq -r '.[].name_value' | sort -u

# 4. Subfinder bundled aggregator (30+ sources)
subfinder -d ${D} -all -recursive -silent

# 5. AlienVault OTX — free, no key
curl -sk "https://otx.alienvault.com/api/v1/indicators/domain/${D}/passive_dns" | \
  jq -r '.passive_dns[].hostname' | sort -u

# 6. ThreatMiner
curl -sk "https://api.threatminer.org/v2/domain.php?q=${D}&rt=5" | jq -r '.results[]'

# 7. URLScan
curl -sk "https://urlscan.io/api/v1/search/?q=domain:${D}" | \
  jq -r '.results[].page.domain' | sort -u

# 8. Anubis-DB (last resort)
curl -sk -A "Mozilla/5.0" "https://anubisdb.com/anubis/subdomains/${D}" | jq -r '.[]'

---

2. Common-Prefix Wordlist

119 prefixes. Passive enum misses 20-40% of high-value subdomains. Pair with active prefix probe when authorized (detectability: low -- single A-record query per host).

www mail webmail owa autodiscover ftp vpn sslvpn gateway api app portal
login sso idp iam identity accounts oauth auth adfs admin intranet hr
sap erp crm support help status grafana kibana docs wiki jira jenkins
gitlab dev test staging stg qa uat sandbox preprod preview careers jobs
eapps old legacy beta tender suppliers procurement
cdn static img images assets media files download upload search shop
store pay payment billing invoice ticket board chat meet video webinar
register signup sso-proxy proxy relay bounce mx smtp imap pop
ns1 ns2 ns3 dns ntp ldap radius vpn2 remote rdp citrix bastion jump
db mysql postgres redis mongo elastic kafka rabbit queue worker cron
monitor prometheus alertmanager vault consul log syslog splunk

2.1 Wordlist Sources

| Source | URL | Notes | | ------------------------ | -------------------------------------------------------------------- | ------------------------------------------------------------- | | **Assetnote Wordlists** | `<https://wordlists.assetnote.io/`> | Best-curated; updated regularly | | **SecLists** | `<https://github.com/danielmiessler/SecLists`> | Subdomains: `Discovery/DNS/subdomains-top1million-110000.txt` | | **jhaddix all.txt**