domain recon

    1

    Passive subdomain enumeration & live host detection

    $9

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned

    Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+22 more

    domain recon

    Example session with this skill installed

    Perform a domain recon on example-corp.com and identify any staging or dev environments.

    • Read your context and instructions
    • Compiled the domain recon

    I have completed the passive reconnaissance for example-corp.com. I queried the certificate transparency logs and verified the status of the discovered subdomains.

    Domain Reconnaissance Report: example-corp.com

    SubdomainStatusTech StackNotes
    www.example-corp.com200 OKNginx, ReactPrimary landing page
    api.example-corp.com200 OKNode.js, ExpressPublic API endpoint
    staging.example-corp.com401NginxStaging environment - requires auth
    dev.example-corp.com403ApacheDev environment - restricted
    admin.example-corp.com200 OKNginx, VueAdmin panel exposed

    Key Findings

    • Found 5 live subdomains out of 12 discovered
    • staging.example-corp.com and dev.example-corp.com are protected but exposed
    • admin.example-corp.com is publicly accessible — worth investigating

    Recommended Next Steps

    1. Test admin panel for authentication bypass
    2. Check staging environment for default credentials
    3. Review API endpoints for rate limiting and auth issues

    ⚠️ All testing must be done with explicit authorization.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Automated Domain Reconnaissance Skill

    Stop wasting hours on manual subdomain enumeration. This skill automates passive reconnaissance using HackerTarget and crt.sh — no paid APIs, no rate limits, no setup.

    What it does

    • Enumerates subdomains passively using certificate transparency logs
    • Checks which subdomains are live
    • Identifies technology stacks
    • Filters for interesting endpoints (admin, api, dev, staging)
    • Generates structured JSON reports

    Perfect for

    • Bug bounty hunters doing initial recon
    • Security researchers mapping attack surfaces
    • Penetration testers on authorized engagements

    Includes

    • SKILL.md with step-by-step methodology
    • Python script for automated enumeration
    • Structured JSON output for further analysis
    • Real example output (51 subdomains for github.com)

    Works with

    Any MCP-compatible agent (Claude Code, Cursor, OpenClaw, etc.)

    ⚠️ Disclaimer

    For authorized security testing only. Only scan domains you own or have explicit written authorization to test.

    How to use

    Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scanned

    Verified clean 5 days ago

    • Passed all security checks, Safe to install

    Requires

    Hackertarget
    Crt

    Listed5 days ago

    What's inside

    Frequently Asked Questions