recon-skills

Why we included this project

Security teams running external web assessments will find this a practical, field-tested reference rather than a pile of one-off PoCs. It bundles a large set of structured skill documents that cover the whole engagement: subdomain, DNS, port, and technology discovery; route, parameter, and API mapping; authentication and SSO testing; and validation of vulnerability classes like CORS, XSS, SQLi, SSRF, and RCE. Each skill records its prerequisites, procedure, common pitfalls, and verification criteria, so it works both as a manual playbook and as task context for an automation harness. The catalog is organized so you can start from broad recon entry points and pull in platform-specific skills (WordPress, cloud, Firebase, Supabase) only when discovery produces a relevant signal. It is a curated knowledge pack for authorized testing, not a turnkey scanner, so it rewards operators who already know their tooling and want a repeatable methodology.