About recon-and-osint
Recon & OSINT is a security skill for discovering an organization's exposed assets before testing begins. It moves from passive research to active discovery and consolidates findings into an inventory for threat modeling, with authorization emphasized throughout.
Key features
- 01Starts with passive footprint research
- 02Discovers domains, hosts, and cloud assets
- 03Fingerprints services and technologies
- 04Finds endpoints, parameters, and exposed secrets
- 05Builds an inventory for threat modeling
Use cases
- 01Finding forgotten staging hosts and buckets
- 02Mapping public endpoints before security testing
- 03Preparing assets for threat modeling
Install
Copy the command and run it in a terminal.
npx skills add https:/After installing, type/recon-and-osintin Claude Code to confirm it loaded.
Bundled filesreferences/recon-playbook.md
Details
From the project READMERecon & OSINT (RECON phase — the front of the lifecycle)
Overview
Find what's actually exposed before deciding what to test. Threat modeling assumes a surface; recon discovers it. Most breaches start at an asset the defender forgot they had.
Core principle: You can't protect what you don't know exists. Enumerate everything first.
⚠️ Authorization
Only enumerate assets you own or are explicitly authorized to test. Passive OSINT on your own org is always safe; active scanning/brute-forcing requires the asset to be in scope.
Method (passive → active)
- Passive footprint (no packets to target) — search engines, certificate transparency, public code, breach data, DNS records, archived pages. Zero noise, often highest value.
- Asset discovery — subdomains, IP ranges, cloud buckets, related domains, forgotten staging.
- Service & tech fingerprinting — what's running, which versions, which frameworks/CMS.
- Content discovery — hidden endpoints, directories, API routes, JS-referenced URLs, params.
- Secret & exposure hunting — leaked keys/tokens in public repos, paste sites, JS bundles, archives.
- Consolidate — turn findings into a target inventory the threat model can rank.
See references/recon-playbook.md for concrete tools and commands per step.
Quick reference — what to hunt
| Category | Goldmine sources |
|---|---|
| Subdomains | crt.sh / cert transparency, subfinder, amass, DNS brute-force |
| Forgotten assets | staging/dev/old subdomains, S3/GCS/Azure buckets, archived pages (Wayback) |
| Tech stack | whatweb, wappalyzer, response headers, favicon hash, JS libs |
| Endpoints/params | gau/waybackurls, JS file parsing, katana, robots/sitemap, Swagger/GraphQL |
| Leaked secrets | GitHub/Gist dorking, trufflehog/gitleaks on public repos, paste sites |
| Exposed creds | breach-corpus lookups for org emails (defensive: know what attackers know) |
Output: target inventory
A list the threat model consumes:
| Asset | Type | Tech | Notable | Exposure |
|---|---|---|---|---|
api.example.com | API host | Node/Express | Swagger exposed | public |
staging.example.com | web | old build | debug=on | should be internal |
Hand-off
Feed the inventory into threat-modeling to rank, then security-code-audit /
api-security-testing for the prioritized targets.
Common mistakes
- Jumping to scanning before passive recon — you make noise and miss the easy wins.
- Enumerating only the main domain — forgotten subdomains/buckets are where breaches live.
- Ignoring JS bundles — they leak endpoints, params, and sometimes keys.
- Testing assets you found but aren't authorized for — discovery ≠ permission.