---
description: Recon target — subdomain enum, port scan, tech fingerprint, OSINT
---

# Recon Target

## Pre-Read Skills
```
view_file: ~/.gemini/skills/predator/SKILL.md
view_file: ~/.gemini/skills/get-competitor-skill-and-method/SKILL.md
view_file: ~/.gemini/skills/mindset/SKILL.md
```

## Steps

// turbo-all

1. **Define Target**
   Ask Ketua for target domain/IP or infer from context.

2. **Passive Recon**
   Use `search_web` + `read_url_content`:
   - Certificate Transparency: `crt.sh/?q=%.target.com`
   - DNS records: `search_web "site:dnsdumpster.com target.com"`
   - Shodan/Censys: search for target IP range
   - WHOIS: registrar, creation date, nameservers

3. **Subdomain Enumeration**
   - Parse crt.sh results
   - Check common subdomains (api, dev, staging, admin, vpn, mail)
   - Verify which are alive (HTTP HEAD)

4. **Technology Fingerprint**
   Apply CMS signatures from `get-competitor-skill-and-method`:
   - HTTP headers analysis (Server, X-Powered-By)
   - CMS detection (WordPress, Joomla, Magento, etc)
   - WAF detection (Cloudflare, Akamai, AWS WAF)

5. **OSINT**
   Apply intelligence synthesis from `mindset` skill:
   - GitHub: `search_web "site:github.com target.com"`
   - Leaked credentials: check paste sites
   - Employee enumeration: LinkedIn patterns

6. **Report**
   Generate recon artifact with attack surface map, subdomain list, and priority targets.