Recon workflows BETA

Send "recon" in your chat and the model replies with these active-scanning workflows and their exact syntax — no need to memorize anything.

Beta — these workflows are still being verified, so double-check the results before relying on them.

• recon:domain <domain>

  Maps a domain's whole external attack surface — its subdomains, which hosts are live and what they run, open ports and services, and known-vulnerability signals — by actively probing the infrastructure.

  subfindercrt.shdighttpxwafw00fnaabunmapnuclei

  How it works

  1. Enumerates subdomains passively with subfinder and certificate-transparency logs (crt.sh), merged into one de-duplicated list.
  2. Reads the DNS records (A, MX, NS, TXT) for the domain.
  3. Probes which subdomains are live with httpx (title, status, detected technologies) and detects any Web Application Firewall with wafw00f.
  4. Discovers open ports on the main host with naabu and confirms the service and version behind each with nmap.
  5. Runs a template-based scan (nuclei, medium severity and above) against the live web hosts.
  6. Reports only what the tools returned — no invented subdomains, ports, or services.
• recon:host <ip|hostname>

  Scans a single host — its open ports, the service and version on each, the web technology it runs, and known-vulnerability signals.

  naabunmaphttpxwafw00fnuclei

  How it works

  1. Discovers open ports with naabu across the top 1000.
  2. Confirms the service and version on each open port with nmap -sV.
  3. Fingerprints any HTTP/HTTPS service with httpx and detects a WAF with wafw00f.
  4. Runs a nuclei template scan against any live web service.
  5. Reports open ports, services and versions exactly as the tools returned them — never a guessed service or OS.
• recon:web <url>

  Recon of a single web application — its technology stack and WAF, the endpoints it exposes, its hidden parameters, and template-based vulnerability signals.

  httpxwhatwebwafw00fkatanawebfetcharjunnuclei

  How it works

  1. Fingerprints the stack with httpx and whatweb and detects a WAF with wafw00f.
  2. Crawls the app for endpoints with katana, rendering JavaScript-heavy or Cloudflare-protected pages with the headless browser (webfetch) when a plain crawl returns little.
  3. Discovers hidden parameters on the main endpoints with arjun.
  4. Runs a nuclei template scan against the target.
  5. Reports the stack, endpoints, parameters and findings — recon only, without attempting exploitation.
• recon:ports <ip|hostname>

  Fast port and service discovery on a host, and nothing else.

  naabunmap

  How it works

  1. Sweeps the top 1000 ports with naabu.
  2. Confirms the service and version on the open ports with nmap -sV.
  3. Reports the open ports with their service and version, and points to recon:host or recon:web for going deeper.

Recon actively sends traffic to the target. Run these workflows only against systems you own or have explicit written permission to test.

Each workflow needs an active Kali Linux machine — the whole toolkit (subfinder, naabu, nmap, httpx, nuclei, katana and more) is pre-installed on it, so the model runs everything live. Rent one in the Virtual Machines section.

Have more than one machine? Add --machine <name> (or -m <name>) to the end of any workflow — e.g. recon:domain example.com --machine kali-recon — to pin every command to that machine. Without it, your active machine is used.

Every recon run saves its full report to a file on your Kali machine (under /root/recon/) and the reply gives you the exact path — download it from the machine card on the home page, or fetch it over SSH with your key.