Recon — Penetration Testing Reconnaissance

Perform structured reconnaissance against an authorized target, organizing findings into an actionable attack surface map.

Cross-references: osint-recon for the deeper open-source-intelligence pass (people, organizations, historical data) — this skill is the active/passive target-mapping side, osint-recon is the broader investigative side; they pair naturally. web-pentest for the next stage once recon has produced an attack surface map and an authorized target list. owasp-audit for source-code review when you have access to the target's code.

Authorization Check

Before running any commands, confirm:

1. The user has written authorization for the target (pentest engagement, bug bounty program, CTF/lab environment)
2. The target is within the defined scope

If authorization is unclear, ask before proceeding. Never assume authorization.

Methodology

Phase 1: Passive Recon

Gather information without touching the target directly.