recon-for-sec
yaklang/hack-skills
Entry-point router for security reconnaissance and methodology on new targets.
What is recon-for-sec?
A starting skill for mapping scope, discovering assets, fingerprinting technology, and building endpoint inventory on unknown attack surfaces. Use this when you receive a new target and need to establish a structured testing methodology before diving into specific vulnerability classes.
- Routes reconnaissance tasks based on target type and collected findings
- Guides asset discovery, port/service identification, and technology fingerprinting
- Builds endpoint inventory and attack surface mapping
- Helps choose follow-up testing paths (API security, authentication, injection, business logic)
- Detects exposed source control (.git, .svn, .hg) and supply chain reconnaissance opportunities
How to install recon-for-sec
npx skills add https://github.com/yaklang/hack-skills --skill recon-for-secHow to use recon-for-sec
- 1.Confirm all in-scope assets and identify target type (web app, API, infrastructure, etc.)
- 2.Perform asset discovery and port/service scanning to build endpoint inventory
- 3.Run technology fingerprinting to identify frameworks, libraries, and versions in use
- 4.Check for exposed source control repositories and internal package names
- 5.Route findings to specialized skills: api-sec for APIs, auth-sec for authentication, injection-checking for input validation, or business-logic-vuln for logic flaws
Use cases
- Starting security assessment on a newly assigned target with unknown scope
- Mapping and inventorying all in-scope assets and services before vulnerability testing
- Fingerprinting technology stack to determine which specialized security tests apply
- Discovering exposed source repositories or internal package names for supply chain risks
- Planning structured testing workflow instead of random payload enumeration
- Security researchers beginning a new engagement
- Penetration testers scoping unknown attack surfaces
- Security engineers building systematic testing methodologies
- DevSecOps teams assessing new applications or infrastructure
recon-for-sec FAQ
Use this skill first when you have a new or unknown target. It establishes scope, discovers assets, and identifies the technology stack—all essential before running targeted tests. This prevents wasted effort on irrelevant tests and ensures you don't miss major attack surfaces.
You should have a structured inventory of in-scope assets, identified services and ports, technology fingerprints, and a prioritized list of follow-up testing paths based on what was discovered.
No. This is a reconnaissance and routing skill. It gathers information and maps the attack surface, then directs you to specialized skills for actual vulnerability testing.
This skill routes you to Insecure Source Code Management and Dependency Confusion skills for deeper investigation of those specific findings.
Full instructions (SKILL.md)
Source of truth, from yaklang/hack-skills.
name: recon-for-sec description: >- Entry P1 category router for reconnaissance and methodology. Use when mapping scope, discovering assets, fingerprinting technology, building endpoint inventory, and choosing the first high-value security testing path.
Recon and Methodology Router
This is the starting router for new targets and unknown attack surfaces.
When to Use
- You just received a new target and do not yet know what to test first
- You need to begin with asset discovery, tech fingerprinting, endpoint inventory, and test-route planning
- You want to build follow-up testing on structured methodology instead of random payload enumeration
Skill Map
- Recon and Methodology
- Insecure Source Code Management — .git/.svn/.hg exposure detection
- Dependency Confusion — Supply chain reconnaissance for internal package names
Recommended Flow
- First confirm in-scope assets and target type
- Then perform asset discovery, port/service identification, technology fingerprinting, and endpoint collection
- Route based on collected findings to api-sec, auth-sec, injection-checking, or business-logic-vuln
Related skills
More from yaklang/hack-skills and the wider catalog.
request-smuggling
HTTP request smuggling and desynchronization testing for proxy/origin framing disagreements.
reverse-shell-techniques
Reverse shell techniques playbook for establishing remote shells across Linux, Windows, and web platforms.
rsa-attack-techniques
Exploit weak RSA keys and parameters via factorization, small exponents, lattice attacks, and oracle techniques.
saml-sso-assertion-attacks
Test SAML SSO assertion signature validation, binding, and trust boundary flaws in enterprise authentication.
sandbox-escape-techniques
Expert sandbox escape techniques across Python, Lua, seccomp, chroot, Docker, browser, and namespace contexts.
smart-contract-vulnerabilities
Expert audit playbook for Solidity/EVM smart contract vulnerabilities: reentrancy, overflow, access control, delegatecall, MEV, and signature replay.