/recon

name: recon
description: >-
  Run scope-bounded reconnaissance for a penetration test: enumerate the
  authorized attack surface (hosts, domains, services, technologies, exposure)
  and organize it for testing. Use at the start of an engagement, strictly within
  the agreed scope.

Goal

A clear, organized attack-surface map for the **in-scope** targets, ready to drive methodology-based testing — with everything tied back to the rules of engagement.

Prerequisites

• **Authorization and explicit scope** (in-scope hosts/domains/IPs, exclusions,

testing window, rules of engagement). Do not enumerate anything out of scope.

Steps

1. **Confirm scope** first. Record what's in/out and any constraints (rate limits, no-touch systems, allowed techniques). 2. **Passive recon** — public/OSINT footprint: domains, subdomains, IP ranges, technologies, exposed services, leaked info. Prefer the `osint` plugin if installed. 3. **Active enumeration** (only if authorized) — live hosts, open ports/services, versions, web endpoints, and tech fingerprinting, respecting rate limits. 4. **Organize the surface** — group by asset/zone; note the technology per target so the right domain methodology applies (web → `web-app-security`, network → `network-security`, cloud → `cloud-security`). 5. **Map it** — optionally produce an attack-surface mindmap or architecture view (`security-diagramming`).

Output

An attack-surface inventory: asset · type · service/tech · exposure · in-scope? · notes, plus a prioritized list of where to begin testing. Findings later flow to `security-reporting`.

Notes

Stay strictly within scope; log what you touched for the report's methodology section. This skill organizes the surface — the per-technology testing lives in the domain plugins.