What problem does it solve? When approaching a new web target, testers often miss attack surface or waste time on low-value paths. This Skill provides a structured reconnaissance and testing methodology so assets, endpoints, and technologies are systematically mapped before vulnerability testing begins. ## Core Features & Use Cases - Subdomain and Asset Enumeration: Passive and active subdomain discovery with subfinder, amass, massdns, and ffuf, plus vhost discovery and port scanning with nmap and httpx. - Endpoint and Parameter Discovery: Directory brute forcing, JavaScript source mining, wayback URL collection, hidden parameter discovery with arjun, and API/GraphQL endpoint detection. - Testing Methodology and Triage: Zseano-style per-input testing sequences, parameter-to-vulnerability mapping, bug bounty program triage, nuclei scanning, and a misconfiguration checklist covering exposed .git, .env, Spring Boot actuators, and Java middleware. - Use Case: Given a new in-scope domain, follow the playbook to enumerate subdomains, fingerprint the tech stack, discover endpoints, then prioritize authentication and file upload features for deeper testing. ## Quick Start Use the recon-and-methodology skill to build a recon plan and testing checklist for the target example.com.
