/recon

Full reconnaissance workflow — subdomain enum, tech detection, WAF fingerprinting, crawling

ogrodev@ogrodev

GitHub

From plugin

fsociety

2063 skills7 agents63 commands

Install

$ npx -y skills add ogrodev/fsociety --agent claude-code

How it fires

How this command gets triggered: by you, by Claude, or both.

Fires itselfClaude auto-loads it when your prompt matches the work.
You can call itInvoke it directly when you want it.
Slash command/recon

Context preview

What this command does when you run it.

Full reconnaissance workflow — subdomain enum, tech detection, WAF fingerprinting, crawling

Command definition

recon.md

description: Full reconnaissance workflow — subdomain enum, tech detection, WAF fingerprinting, crawling
allowed-tools: ToolSearch, Bash, Read, Write, Glob, Grep, Task
argument-hint: <target-domain>

> **Storage Policy**: ALL output files MUST be saved in the project directory. NEVER write to `/tmp/` or any system temporary directory.

Reconnaissance Workflow

Target: `$ARGUMENTS`

Execute a comprehensive reconnaissance workflow against the target using Hexstrike MCP tools. Follow this sequence:

Step 1: Load Tools

Use ToolSearch to load these Hexstrike tools:

`subfinder_scan` — passive subdomain enumeration
`httpx_probe` — HTTP probing and tech detection
`wafw00f_scan` — WAF detection and fingerprinting
`detect_technologies_ai` — AI-powered technology identification
`katana_crawl` — web crawling for endpoint discovery
`gau_discovery` — historical URL discovery from archives
`nmap_scan` — port scanning for initial service identification

Step 2: Subdomain Enumeration

Run `subfinder_scan` against the target domain to discover subdomains. Then probe discovered subdomains with `httpx_probe` to identify live hosts and their technologies.

Step 3: WAF Detection

Run `wafw00f_scan` on each live subdomain to identify WAF/CDN protection. This is critical for later attack planning — tools and payloads must be selected based on WAF type.

Step 4: Technology Detection

Run `detect_technologies_ai` on the main target and key subdomains. This identifies the full tech stack (CMS, frameworks, languages, servers) and recommends testing approaches.

Step 5: Port Scanning

Run `nmap_scan` against the target for a standard port scan to identify open services beyond HTTP/HTTPS.

Step 6: Crawling & URL Discovery

Run `katana_crawl` on the main target for deep crawling with JavaScript rendering. Also run `gau_discovery` to find historical URLs from web archives that may reveal hidden endpoints.