Skip to content
Get packs

Attack Surface Recon

Maps a target's attack surface using passive and active recon tools, with CDN and fingerprinting tricks.

Source Download skill
Repository
AIPentest/CyberStrikeAI
Stars
8,323
Licence
Apache-2.0
Files
1 file

What it does

When installed, the agent starts a security assessment by mapping what an organisation exposes on the internet before attempting any exploitation. It follows a structured checklist: first passive lookups (WHOIS, certificate transparency logs, DNS comparisons, Shodan/FOFA searches) that do not touch the target directly, then active scanning with tools such as subfinder, httpx, naabu, katana and nuclei. It also includes guidance on spotting CDNs, catch-all web servers, and common hosting panels, and records findings as it goes.

Great for

  • Penetration testers and red teams starting an authorised engagement
  • Security engineers who want a repeatable recon checklist
  • Bug bounty hunters working within a program's scope

Skip it if

  • Anyone testing systems they do not own or have written permission to test, since the active scanning and fuzzing steps can be illegal and disruptive without authorisation
  • Beginners with no security background, because the output assumes familiarity with tools like nmap, DNS and HTTP responses
  • Environments where active scanning is prohibited by policy or contract, since the active pipeline sends traffic to targets

Try asking

  • “Start recon on example.com for my authorised penetration test and map its subdomains and exposed services”
  • “Check whether this domain is behind a CDN and find the real origin IP using DNS resolver comparison”
  • “Identify the web framework and version of these hosts and suggest which vulnerabilities to research next”
Step-by-step guide: how to use Attack Surface ReconInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the Apache-2.0 licence and an attribution note.

    attack-surface-recon.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip attack-surface-recon.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip attack-surface-recon.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only use this on targets you are explicitly authorised to test, and confirm scope before running active steps like naabu, ffuf and nuclei.
  • Run the passive steps first and review results before moving to active scanning, as the skill recommends.
  • Adjust hardcoded paths such as /root/nuclei-templates and /usr/share/seclists to match your system, and replace placeholders like {domain} and {ASN} before running commands.

What's inside

  • SKILL.md

Redistributed unmodified from AIPentest/CyberStrikeAI under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.