recon-skills is a curated catalog of reconnaissance and web pentest skill documents, giving authorized testers structured procedures, pitfalls, and verification criteria for external assessments.
| Tool | uphiago/recon-skills — a curated pack of documented security skills for reconnaissance, web app testing, and reporting |
| Category | Methodology / skill catalog for offensive security automation (Python, MIT) |
| Primary Use | Guiding authorized external web assessments, from subdomain-enumeration and web-enumeration through validation and report-writing |
| Safe Use | The README states explicitly that skills are for authorized testing only, on targets you own or have explicit written permission to test; suitable for labs, bug bounty programs in scope, and client engagements |
| Telemetry Note | The pack itself is documentation-driven; the commands it references assume standard Linux tooling and write artifacts under ${OUTPUT_DIR:-./output}, so defenders observing its use would see the network footprint of whatever discovery tools the operator runs, not a novel agent |
uphiago/recon-skills is not another scanner; it is a structured knowledge base; it is a structured knowledge base — a catalog of self-contained skill documents, each SKILL.md describing one focused objective with its prerequisites, procedure, pitfalls, verification criteria, and related techniques. The repository sits at the intersection of two trends in offensive tooling: the codification of pentest methodology into machine-readable playbooks, and the rise of agent frameworks (the topic list includes hermes-agent, and the README notes skills "can be followed manually or loaded as task context by an automation system") that consume such documents as operational context. With 1279 stars, an MIT license, and a Python validator for catalog consistency, it reads as a serious community effort rather than a weekend dump of cheat sheets.
The scope, per the README, is primarily external web security. The catalog covers subdomain, DNS, port, HTTP, and technology discovery; route, parameter, JavaScript, source-map, and API mapping; authentication, authorization, session, OAuth, SAML, and MFA testing; vulnerability and framework-specific validation; cloud, identity, container, and exposed-infrastructure pivots; and finally evidence review, attack-path analysis, and reporting. That last clause matters. Most recon repositories stop at enumeration; this one explicitly includes redteam/triage-validation, redteam/evidence-hygiene, and redteam/report-writing, closing the loop from discovery to a defensible deliverable.
Structurally, the repository is organized into six top-level directories: auth/ for authentication and SSO testing, chains/ for multi-step attack-path analysis, infra/ for infrastructure-focused techniques, meta/ for engagement planning and cross-skill workflows, recon/ for discovery and focused validation, and redteam/ for vulnerability-class and platform playbooks. This taxonomy is itself instructive — it encodes a maturity model where reconnaissance, exploitation reasoning, and reporting are separate disciplines with their own quality bars, rather than one amorphous pentest/ folder.
Getting started is deliberately minimal. The README suggests cloning the repository and locating skills that match the observed surface, using find . -name SKILL.md -print | sort to list the catalog and rg -n "SSRF|OAuth|GraphQL|Kubernetes" --glob 'SKILL.md' to grep across skill bodies. For a broad external web assessment, the recommended entry points are redteam/web2-recon, recon/subdomain-enumeration, recon/web-enumeration, and redteam/bb-methodology, with vulnerability or platform skills layered in only when discovery produces a relevant signal. That gating — enumerate first, specialize on signal — is a sound methodological stance that distinguishes the pack from spray-and-pray tooling.
The README also instructs operators to set a writable output location before running examples: export OUTPUT_DIR="${OUTPUT_DIR:-./output}" followed by mkdir -p "$OUTPUT_DIR". Commands assume standard Linux tooling unless a skill states otherwise, and the README is refreshingly explicit that tool availability, scope, network policy, concurrency, credentials, and isolation "remain the operator's responsibility." This is the kind of disclaimer that signals the author understands the difference between documentation and orchestration — the pack does not manage your boundaries for you.
A high-signal entry-point table maps named skills to purposes: meta/recon-playbook for end-to-end recon workflow and escalation gates, redteam/offensive-osint for external intelligence and asset pivots, recon/port-service-discovery for port and service classification, recon/js-secrets-extraction for client-side bundle and secret analysis, chains/cross-attack-chains for evidence-based attack-path construction, and redteam/bb-methodology for bug bounty prioritization. The hunt-* family covers individual vulnerability classes and platform surfaces — the repo topics mention cors-exploitation, ssrf, jwt-attacks, firebase-hacking, supabase, and wordpress-security, which gives a fair picture of the platform depth on offer.
Two skills deserve particular attention from a tradecraft perspective. chains/cross-attack-chains frames attack-path construction as evidence-based — meaning findings must be chained from actually observed artifacts rather than hypothesized impact, which is exactly the discipline that separates reportable bugs from speculative noise. And redteam/evidence-hygiene addresses reproducible and redacted evidence capture, a competency that is chronically under-taught and directly relevant to bug bounty triage quality and client-facing engagements alike.
Quality control is handled programmatically. The repo ships scripts/validate_skills.py, invoked as python3 scripts/validate_skills.py, which fails on structural errors while reporting existing style debt separately as warnings for incremental improvement. The author maintains a quality baseline in STYLE.md, contributor guidance in AGENTS.md, and operating principles in SOUL.md. Older skills are being migrated to the full baseline incrementally, an honest admission that a catalog like this is never finished — attack surfaces and platform behaviors drift, and documentation rots faster than code.
For defenders, this repository is worth reading precisely because it catalogs what a methodical adversary's reconnaissance phase looks like when done well. The topics list — subdomain enumeration, JS secret extraction, exposed Firebase and Supabase backends, misconfigured CORS, OAuth flows — is effectively a checklist of external attack-surface hygiene gaps. Blue teams can map each skill to a detection or hardening question: what passive DNS footprint does our estate leak, what secrets live in shipped JavaScript bundles, which cloud databases are publicly reachable.
From a safety standpoint, the project is framed correctly from the first paragraph: the README states in a blockquote that these skills are for authorized security testing only, and to test only targets you own or have explicit written permission to test. Nothing in the README itself constitutes a weaponized exploit chain; it is methodology documentation plus standard-tool invocations, with outputs confined to the operator's local ${OUTPUT_DIR:-./output}. The risk profile is entirely in how it is used, and the project makes its authorized-use expectation unambiguous.
Where this pack fits in an authorized workflow is as the connective tissue between raw tooling and professional deliverables. An operator running subfinder, httpx, or a JS analyzer gets output; recon-skills tells them what to do with it, which pitfalls produce false positives, what verification criteria a finding must meet before it earns a line in the report, and how to redact evidence. For bug bounty hunters drowning in undifferentiated recon output, and for consultants who need repeatable methodology across engagements, that scaffolding is often more valuable than another point tool — and at 1279 stars with active incremental maintenance, it appears the community agrees.
uphiago/recon-skills.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.