Individual skill

stealth-web-recon

WAF-aware, rate-limited external recon and web asset discovery for bug bounty / authorized pentest targets. Avoids triggering Cloudflare / openresty / generic WAF blocks while still mapping subdomains, panels, and tech stack.

skills/security/stealth-web-recon/SKILL.md

Read pinned source

Source commit 961a0dd3d2d2f66a07a416ade3b1d4473b64802e

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: No
Repository scan complete: No
Skill scan complete: No
Observed behavior: Not checked yet
Last checked: Nov 4, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 1,011
Repository last updated: Nov 5, 2026
License: Apache-2.0

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

ai-agent Repository topic
appsec Repository topic
bug-bounty Repository topic
cybersecurity Repository topic
devsecops Repository topic
exploit-validation Repository topic
hermes-agent Repository topic
infosec Repository topic
llm-security Repository topic
nuclei Repository topic
security Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

SKILL.mdcore · 6,189 bytes
SKILL.mdcore · 6,189 bytes
SKILL.mdcore · 6,189 bytes
references/cve-version-matching.mddoc · 2,159 bytes
references/katana_pitfalls.mddoc · 1,645 bytes
references/stealth-recon.mddoc · 2,050 bytes

Read excerpt


# Stealth Web Recon — WAF-Aware Asset Discovery

## Purpose
Map a target's external attack surface (subdomains, live web services, exposed panels, tech stack) WITHOUT getting blocked by Cloudflare, openresty rate limits, or other WAFs. The user explicitly requires blocks to be avoided — treat "don't trigger the WAF" as a hard constraint, not a nice-to-have.

This is a companion to the `recon` skill: use `recon` for the generic flow, this skill for the STEALTH discipline and command set that keeps you under WAF radar.

## Core principle: passive first, active last, never burst
1. **Passive enumeration** (crt.sh, subfinder, gau/Wayback) gathers hosts with zero requests to the target.
2. **DNS resolution** (dnsx) is borderline-passive — uses public resolvers, but space the queries.
3. **Active HTTP probing** (httpx) is the only step that "hits" the target — keep it slow and rate-limited.
4. **Content scanning** (katana/ffuf/arjun) is skipped entirely on WAF/Bot-Management hosts.

## Workflow (worked, zero-block sequence)