What are the main stages of the reconnaissance workflow?

The workflow chains ten stages: project/acquisition tracking, subdomain enumeration, live host discovery, technology fingerprinting, content discovery, application analysis using Jason Haddix's heat-map method, automated XSS hunting, Nuclei-driven vulnerability scanning, API endpoint enumeration, and a combined bash recon script that ties subdomain discovery through to final Nuclei scanning.

What are the restrictions on how this skill can be used?

It must only be used against authorized targets with explicit permission, within defined scope and program rules. It cannot be used for denial-of-service attacks or aggressive fuzzing against production systems, and requests must be rate-limited to avoid getting blocked.

What inputs and API keys are required to run this skill?

You need a defined target scope, bug bounty program rules, installed tool dependencies (Go/Python/Ruby tooling on Linux), and API keys for services like Shodan and Censys.

Skill

Automate Red Team Reconnaissance and Vulnerability Discovery

Name: Red Team Tools and Methodology
Availability: OnlineOnly
Author: Antigravity

Authorized recon and bug-bounty methodology: subdomain enumeration, live host discovery, XSS hunting, and Nuclei vulnerability scanning.

Get skill

Works with githubcrunchbaseshodancensysamass

Antigravity

Own this? Claim it

Spark score

out of 100

Updated yesterday

Version 15.7.0

Add to Favorites

Why it matters

Execute comprehensive red team operations by automating reconnaissance, vulnerability discovery, and bug bounty hunting using proven methodologies and toolchains from security experts.

Outcomes

What it gets done

Automate subdomain enumeration and live host discovery.

Perform technology fingerprinting and content discovery.

Identify and exploit vulnerabilities using automated scanning.

Streamline reconnaissance with a custom automated script.

Install

Add it to your toolbox

Run in your project directory:

curl -fsSL https://spark.entire.vc/get/ag-red-team-tools | bash

Overview

Red Team Tools and Methodology

Automates authorized bug bounty reconnaissance: subdomain enumeration, live host and technology discovery, content discovery, XSS hunting, and Nuclei vulnerability scanning. Use for authorized bug bounty or sanctioned security assessments with a defined scope, not against any target without explicit authorization.

What it does

Implements proven methodologies and tool workflows for reconnaissance, vulnerability discovery, and bug bounty hunting, for authorized security assessments, defensive validation, or controlled educational environments only. It automates common recon tasks - subdomain enumeration, live host discovery, technology fingerprinting, content discovery, and vulnerability scanning - while aiming for thorough coverage of a target's attack surface.

When to use - and when NOT to

Use this skill for authorized bug bounty engagements or sanctioned security assessments where scope (domains, IP ranges, applications) and program rules are already defined, and a Linux-based attack machine (Kali, Ubuntu) with the relevant Go/Python/Ruby tooling is available. Not for use against any target without explicit authorization, and not for denial-of-service or aggressive fuzzing against production systems - the source's own constraints call for respecting program scope, avoiding DoS, and rate-limiting requests to avoid getting blocked.

Inputs and outputs

Inputs are a defined target scope, bug bounty program rules, installed tool dependencies, and API keys for services like Shodan and Censys. The core workflow chains ten stages: project/acquisition tracking (via Amass intel or BGP.he.net ASN lookups), subdomain enumeration (Amass, Subfinder, assetfinder, findomain, dnsgen permutations), live host discovery (httprobe, httpx, massdns), technology fingerprinting (Whatweb, Nuclei technology templates), content discovery (ffuf directory bruteforce, waybackurls, gau, parameter extraction), application analysis following Jason Haddix's heat-map method (prioritizing file uploads, content types, APIs, profile sections, integrations, and error pages as high-value injection points), automated XSS hunting (ParamSpider, Gxss, Dalfox), Nuclei-driven vulnerability and CVE scanning, API endpoint enumeration and HTTP-method fuzzing, and a combined bash recon script that chains subdomain discovery through live-host detection, URL collection, and a final Nuclei scan. Outputs are subdomain lists, live-host and technology reports, discovered endpoints and parameters, XSS and vulnerability findings, and documented results ready for a bug bounty report.

Integrations

Chains together a standard bug bounty toolchain: Amass, Subfinder, assetfinder, findomain, and dnsgen for subdomain discovery; httprobe, httpx, and massdns for live-host resolution; Whatweb and Nuclei for technology and vulnerability detection; ffuf, waybackurls, and gau for content and historical URL discovery; and ParamSpider, Gxss, and Dalfox for automated XSS testing. Burp Suite is used alongside these for manual verification of automated findings.

subfinder -d target.com | httpx -title | tee results.txt

Who it's for

Bug bounty hunters and security researchers running authorized reconnaissance and vulnerability discovery against in-scope targets, who need a repeatable tool chain rather than assembling recon commands from scratch for each engagement.

Source README

Implement proven methodologies and tool workflows from top security researchers for effective reconnaissance, vulnerability discovery, and bug bounty hunting. Automate common tasks while maintaining thorough coverage of attack surfaces.

FAQ

Common questions

Discussion