/recon

description: Full reconnaissance workflow — subdomain enum, tech detection, WAF fingerprinting, crawling
allowed-tools: ToolSearch, Bash, Read, Write, Glob, Grep, Task
argument-hint: <target-domain>

> **Storage Policy**: ALL output files MUST be saved in the project directory. NEVER write to `/tmp/` or any system temporary directory.

Reconnaissance Workflow

Target: `$ARGUMENTS`

Execute a comprehensive reconnaissance workflow against the target using Hexstrike MCP tools. Follow this sequence:

Step 1: Load Tools

Use ToolSearch to load these Hexstrike tools:

• `subfinder_scan` — passive subdomain enumeration
• `httpx_probe` — HTTP probing and tech detection
• `wafw00f_scan` — WAF detection and fingerprinting
• `detect_technologies_ai` — AI-powered technology identification
• `katana_crawl` — web crawling for endpoint discovery
• `gau_discovery` — historical URL discovery from archives
• `nmap_scan` — port scanning for initial service identification

Step 2: Subdomain Enumeration

Run `subfinder_scan` against the target domain to discover subdomains. Then probe discovered subdomains with `httpx_probe` to identify live hosts and their technologies.

Step 3: WAF Detection

Run `wafw00f_scan` on each live subdomain to identify WAF/CDN protection. This is critical for later attack planning — tools and payloads must be selected based on WAF type.

Step 4: Technology Detection

Run `detect_technologies_ai` on the main target and key subdomains. This identifies the full tech stack (CMS, frameworks, languages, servers) and recommends testing approaches.

Step 5: Port Scanning

Run `nmap_scan` against the target for a standard port scan to identify open services beyond HTTP/HTTPS.

Step 6: Crawling & URL Discovery

Run `katana_crawl` on the main target for deep crawling with JavaScript rendering. Also run `gau_discovery` to find historical URLs from web archives that may reveal hidden endpoints.

Step 7: Save Results

Save a structured reconnaissance summary to the project directory as `recon-{target}.md` including:

• Discovered subdomains and their status
• WAF/CDN information per host
• Technology stack details
• Open ports and services
• Discovered endpoints and URLs
• Recommended next steps based on findings

Present a concise summary table to the operator when complete.