/recon

name: recon
description: Run full recon pipeline on a target — subdomain enum (Chaos API + subfinder), live host discovery (dnsx + httpx), URL crawl (katana + waybackurls + gau), gf pattern classification, nuclei scan. Outputs to recon/<target>/ directory. Usage: /recon target.com

/recon

Run the full recon pipeline on a target and produce a prioritized attack surface.

What This Does

1. Enumerates subdomains (Chaos API + subfinder + assetfinder) 2. Resolves DNS and finds live hosts (dnsx + httpx with status/title/tech) 3. Crawls URLs (katana deep crawl + waybackurls + gau historical) 4. Classifies URLs by bug class (gf patterns) 5. Runs nuclei for known CVEs and misconfigs 6. Outputs prioritized attack surface summary

Usage

/recon target.com

Or with specific focus:

/recon target.com --focus api
/recon target.com --focus auth
/recon target.com --fast     (skip historical URLs)

Steps

Step 1: Subdomain Enumeration

TARGET="$1"
mkdir -p recon/$TARGET

# Chaos API (ProjectDiscovery — most comprehensive)
curl -s "https://dns.projectdiscovery.io/dns/$TARGET/subdomains" \
  -H "Authorization: $CHAOS_API_KEY" \
  | jq -r '.[]' > recon/$TARGET/subdomains.txt

# subfinder + assetfinder
subfinder -d $TARGET -silent | anew recon/$TARGET/subdomains.txt
assetfinder --subs-only $TARGET | anew recon/$TARGET/subdomains.txt

echo "[+] Subdomains: $(wc -l < recon/$TARGET/subdomains.txt)"

Step 2: Live Host Discovery

# DNS resolve + HTTP probe with tech detection
cat recon/$TARGET/subdomains.txt \
  | dnsx -silent \
  | httpx -silent -status-code -title -tech-detect \
  | tee recon/$TARGET/live-hosts.txt

echo "[+] Live hosts: $(wc -l < recon/$TARGET/live-hosts.txt)"

Step 3: URL Crawl

# Active crawl
cat recon/$TARGET/live-hosts.txt | awk '{print $1}' \
  | katana -d 3 -jc -kf all -silent \
  | anew recon/$TARGET/urls.txt

# Historical URLs
echo $TARGET | waybackurls | anew recon/$TARGET/urls.txt
gau $TARGET --subs | anew recon/$TARGET/urls.txt

echo "[+] Total URLs: $(wc -l < recon/$TARGET/urls.txt)"

Step 4: Classify URLs

# Bug class classification — gf patterns
cat recon/$TARGET/urls.txt | gf xss       > recon/$TARGET/xss-candidates.txt
cat recon/$TARGET/urls.txt | gf ssrf      > recon/$TARGET/ssrf-candidates.txt
cat recon/$TARGET/urls.txt | gf idor      > recon/$TARGET/idor-candidates.txt
cat recon/$TARGET/urls.txt | gf sqli      > recon/$TARGET/sqli-candidates.txt
cat recon/$TARGET/urls.txt | gf redirect  > recon/$TARGET/redirect-candidates.txt
cat recon/$TARGET/urls.txt | gf lfi       > recon/$TARGET/lfi-candidates.txt
cat recon/$TARGET/urls.txt | gf rce       > recon/$TARGET/rce-candidates.txt
cat recon/$TARGET/urls.txt | gf ssti      > recon/$TARGET/ssti-candidates.txt
cat recon/$TARGET/urls.txt | gf interestingparams > recon/$TARGET/interesting-candidates.txt

# Open redirect params (extra patterns not in gf)
grep -E "(\?|&)(redirect|next|return|dest|destination|go|forward|target|redir|url|continue|returnTo|returnUrl|callback|out|link)=" \
  recon/$TARGET/urls.txt | anew recon/$TARGET/redirect-candidates.txt

# CORS check candidates
grep -E "(\?|&)(callback|jsonp|cb|_callback)=" recon/$TARGET/urls.txt \
  > recon/$TARGET/cors-jsonp-candidates.txt

# Host header / password reset candidates
cat recon/$TARGET/urls.txt | grep -E "/(forgot|reset|password|recovery)" \
  > recon/$TARGET/host-header-candidates.txt

# File upload candidates
cat recon/$TARGET/urls.txt | grep -E "/(upload|import|attach|file|document|image|avatar|profile)" \
  > recon/$TARGET/upload-candidates.txt

# API endpoints
cat recon/$TARGET/urls.txt | grep -E "/api/|/v1/|/v2/|/v3/|/graphql|/rest/|/gql" \
  > recon/$TARGET/api-endpoints.txt

# Auth/session endpoints
cat recon/$TARGET/urls.txt | grep -E "/(login|logout|signin|signup|register|auth|oauth|sso|token|session)" \
  > recon/$TARGET/auth-endpoints.txt

# Admin panels
cat recon/$TARGET/live-hosts.txt | awk '{print $1}' | while read host; do
  for path in /admin /admin/ /dashboard /wp-admin /jenkins /grafana /kibana /phpmyadmin /adminer; do
    STATUS=$(curl -s -o /dev/null -w "%{http_code}" --max-time 5 "$host$path")
    [ "$STATUS" != "404" ] && [ "$STATUS" != "000" ] && echo "$STATUS $host$path"
  done
done > recon/$TARGET/admin-panels.txt

echo "[+] IDOR candidates:    $(wc -l < recon/$TARGET/idor-candidates.txt)"
echo "[+] SSRF candidates:    $(wc -l < recon/$TARGET/ssrf-candidates.txt)"
echo "[+] LFI candidates:     $(wc -l < recon/$TARGET/lfi-candidates.txt)"
echo "[+] Redirect candidates:$(wc -l < recon/$TARGET/redirect-candidates.txt)"
echo "[+] Upload candidates:  $(wc -l < recon/$TARGET/upload-candidates.txt)"
echo "[+] API endpoints:      $(wc -l < recon/$TARGET/api-endpoints.txt)"
echo "[+] Auth endpoints:     $(wc -l < recon/$TARGET/auth-endpoints.txt)"
echo "[+] Admin panels found: $(wc -l < recon/$TARGET/admin-panels.txt)"

Step 5: Nuclei Scan

# Full severity scan
nuclei -l recon/$TARGET/live-hosts.txt \
  -t ~/nuclei-templates/ \
  -severity critical,high,medium \
  -o recon/$TARGET/nuclei.txt

# Focused CVE scan (critical/high CVEs only)
nuclei -l recon/$TARGET/live-hosts.txt \
  -t ~/nuclei-templates/cves/ \
  -severity critical,high \
  -o recon/$TARGET/nuclei-cves.txt

# Misconfiguration scan
nuclei -l recon/$TARGET/live-hosts.txt \
  -t ~/nuclei-templates/misconfiguration/ \
  -o recon/$TARGET/nuclei-misconfig.txt

# Exposed panels/services
nuclei -l recon/$TARGET/live-hosts.txt \
  -t ~/nuclei-templates/exposed-panels/ \
  -t ~/nuclei-templates/exposed-services/ \
  -o recon/$TARGET/nuclei-exposed.txt

echo "[+] Nuclei findings:      $(wc -l < recon/$TARGET/nuclei.txt)"
echo "[+] CVE findings:         $(wc -l < recon/$TARGET/nuclei-cves.txt)"
echo "[+] Misconfig findings:   $(wc -l < recon/$TARGET/nuclei-misconfig.txt)"
echo "[+] Exposed panel/svc:    $(wc -l < recon/$TARGET/nuclei-exposed.txt)"

Step 6: JS Secret Scan

#