recon-for-sec

A starting-point router for security reconnaissance and methodology, meant to be loaded first when facing a new target or an unknown attack surface. Rather than jumping straight into payloads, it frames the early phase of an assessment around structured discovery: confirming in-scope assets and target type, then performing asset discovery, port and service identification, technology fingerprinting, and endpoint inventory before any exploitation is attempted.

It is designed for the moment when a tester has just received a target and does not yet know what to test first, and wants to build follow-up testing on a documented methodology instead of random enumeration. As a router, its main job is to point to the right next skill: it maps to a fuller Recon and Methodology skill, plus focused reconnaissance skills for insecure source-code management (detecting exposed .git, .svn, and .hg directories) and dependency confusion (supply-chain reconnaissance for internal package names).

The recommended flow is to first confirm scope and target type, then collect assets, services, technologies, and endpoints, and finally route based on findings into downstream testing skills for API security, authentication, injection checking, or business-logic vulnerabilities. Because it is intentionally lightweight, it works as an index and decision aid at the top of an engagement rather than a deep technical playbook, ensuring reconnaissance is completed and organized before deeper category-specific testing begins.