Recon Quick

该 Skill 通过 python3 脚本封装 bbot 与 nmap，提供 subdomains、ports、web、full、passive 五种预设，一条命令完成子域名枚举、端口扫描、Web 技术指纹与 nuclei 扫描，结果按目标域名写入文本文件并汇总为 JSON 报告；需预先安装 bbot 与 nmap。

hostilespider

热度 53.03

最近更新 2026-05-11 17:38:03

分类：安全依赖：代码执行 / 读写文件应用场景：研究 / 自动化脚本 / 报告撰写 / 数据处理

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add recon-quick

Metadata

name: recon-quick
description: Fast OSINT and reconnaissance presets using bbot and nmap. One-command subdomain enumeration, port scanning, and web fingerprinting for bug bounty recon.
metadata: {"openclaw":{"emoji":"🔍","requires":{"bins":["bbot","nmap"]},"install":[{"id":"bbot","kind":"pipx","packages":["bbot"],"label":"Install bbot via pipx"}]}}

Recon Quick — Fast OSINT Presets

One-command recon using bbot and nmap. Preset workflows for common bug bounty recon tasks.

Prerequisites

pipx install bbot
# nmap: apt install nmap / brew install nmap

Quick Start

# Full subdomain enumeration + web probe
python3 {baseDir}/scripts/recon.py target.com --preset full

# Just subdomains
python3 {baseDir}/scripts/recon.py target.com --preset subdomains

# Quick port scan top 100
python3 {baseDir}/scripts/recon.py target.com --preset ports

Presets

Preset	What it does	Time
`subdomains`	Subdomain enum via bbot	2-10 min
`ports`	Top 100 ports + service detection	1-5 min
`web`	HTTP probe + tech fingerprint	2-5 min
`full`	Subdomains + ports + web + nuclei	10-30 min
`passive`	Passive recon only (DNS, certs, APIs)	1-3 min

Options

--preset PRESET — Recon preset (default: subdomains)
--output DIR — Output directory (default: ./recon-output)
--json — Output as JSON
--threads N — Thread count (default: 10)
--wordlist FILE — Custom wordlist for subdomain brute
--proxy URL — Proxy for web requests

Output Structure

recon-output/
├── target.com/
│   ├── subdomains.txt      # Discovered subdomains
│   ├── live-hosts.txt       # Alive HTTP services
│   ├── ports.txt            # Open ports
│   ├── tech-fingerprints.txt # Detected technologies
│   ├── nuclei-findings.txt  # Vulnerability scan results
│   └── full-report.json     # Everything combined

Integration with Bug Bounty

# Run recon, generate report
python3 recon.py target.com --preset full --output ./bounties/target
bb-report-template --type recon --target target.com -o report.md

Notes

bbot handles rate limiting and scope validation automatically
Nuclei findings are informational — manual verification required
Always check program scope before scanning
Use --proxy socks5://127.0.0.1:9050 for Tor