🎁 Get the FREE AI Skills Starter Guide β€” Subscribe β†’
BytesAgainBytesAgain
BytesAgain β€Ί Skills β€Ί web-recon
πŸ¦€ ClawHub

web-recon

by @p0lish

Website vulnerability scanner and security audit toolkit. Scan any website for security issues: open ports (nmap), exposed secrets, subdomain enumeration, di...

Versionv0.1.0
Downloads942
Installs2
Stars⭐ 1
#clawhub
TERMINAL
clawhub install web-recon

πŸ“– About This Skill

name: web-recon description: "Website vulnerability scanner and security audit toolkit. Scan any website for security issues: open ports (nmap), exposed secrets, subdomain enumeration, directory bruteforce, security header scoring, CORS misconfigurations, SSL/TLS analysis, WordPress vulnerabilities, and more. One command, full report. Pentesting and OSINT reconnaissance for web applications."

Web Recon

All-in-one web security scanner for pentesting, bug bounty, and security audits.

Scan any target with a single command and get a structured report with findings prioritized by severity. Modular β€” run the full suite or pick individual steps.

Why Use This

  • One command β†’ full security assessment with prioritized findings
  • 12 scan modules β€” DNS, ports, fingerprinting, subdomains, directories, secrets, vulnerabilities, headers, CORS, SSL, WordPress, Nuclei templates
  • Security header scoring β€” instant letter-grade for any site's HTTP security posture
  • Secrets detection β€” 459 rules covering AWS, GCP, GitHub, Slack, databases, and more
  • Skips missing tools gracefully β€” works with whatever you have installed
  • Resume mode β€” pick up where a crashed scan left off
  • JSON + Markdown reports β€” machine-readable and human-readable output

    • Quick Start

    # Quick scan (recon, fingerprint, secrets, header scoring, report)
scripts/webscan.sh example.com --quick
    Full scan (all 12 steps)
    
scripts/webscan.sh example.com
    Full scan with JSON output and screenshot
    
scripts/webscan.sh example.com --json --screenshot
    Resume a crashed scan (skips completed steps)
    
scripts/webscan.sh example.com --resume
    Single step
    
scripts/webscan.sh example.com recon
scripts/webscan.sh example.com vulns
    Secrets scan only
    
scripts/titus-web.sh https://example.com

    Output: ~/.openclaw/workspace/recon//

    Options

    | Flag | Description | |------|------------| | --quick | Light scan: recon, fingerprint, secrets, vulns, report | | --full | All steps (default) | | --json | Generate results.json alongside markdown report | | --screenshot | Capture homepage screenshot | | --resume | Skip steps that already have output files |

    Environment Variables

    | Variable | Purpose | |----------|---------| | SHODAN_API_KEY | Shodan API key for infrastructure intel (falls back to CLI) | | OUTDIR | Override output directory |

    Scan Modules

    | Step | What it does | Tools | |------|-------------|-------| | recon | DNS records, IP geolocation, port scan, Shodan, Wayback URLs | nmap, dig, Shodan | | fingerprint | HTTP headers, tech stack, WAF detection, CMS check | WhatWeb, wafw00f | | subdomains | Subdomain enumeration + live probing | Subfinder, Amass, httpx | | dirs | Directory and file bruteforce | Gobuster, ffuf | | secrets | Secrets scan + sensitive file checks (30+ paths) | Titus (459 rules) | | vulns | Security header scoring, CORS check, SSL analysis, vulnerability scan | Nikto, custom | | wpscan | WordPress-specific vulnerabilities (auto-skips if not WP) | WPScan | | nuclei | Template-based CVE scanning | Nuclei | | ssl | Full SSL/TLS analysis | testssl | | screenshot | Homepage capture | cutycapt/chromium | | report | Markdown + JSON report generation | β€” |

    Security Header Scoring

    Scores 10 security headers by severity:

    | Severity | Points | Headers | |----------|--------|---------| | Critical | 30 | Strict-Transport-Security, Content-Security-Policy | | High | 20 | X-Frame-Options | | Medium | 10 | X-Content-Type-Options, Referrer-Policy, Permissions-Policy | | Low | 5 | X-XSS-Protection, COOP, CORP, COEP |

    Rating: 🟒 β‰₯80% Β· 🟑 β‰₯50% Β· 🟠 β‰₯25% Β· πŸ”΄ <25%

    Output Structure

    ~/.openclaw/workspace/recon//
β”œβ”€β”€ results.md              # Markdown report with executive summary
β”œβ”€β”€ results.json            # Machine-readable report (--json)
β”œβ”€β”€ screenshot.png          # Homepage capture (--screenshot)
β”œβ”€β”€ dns.txt / geo.json      # DNS records, IP geolocation
β”œβ”€β”€ ports.txt               # nmap port scan results
β”œβ”€β”€ shodan.json             # Shodan infrastructure data
β”œβ”€β”€ header-score.txt        # Security header score card
β”œβ”€β”€ cors.txt                # CORS misconfiguration check
β”œβ”€β”€ whatweb.txt / waf.txt   # Tech fingerprint, WAF detection
β”œβ”€β”€ subdomains-live.txt     # Discovered live subdomains
β”œβ”€β”€ dirs.txt                # Discovered directories/files
β”œβ”€β”€ sensitive-files.txt     # Exposed config/backup files
β”œβ”€β”€ titus.txt               # Leaked secrets/API keys
β”œβ”€β”€ nikto.txt / nuclei.txt  # Vulnerability findings
β”œβ”€β”€ ssl.txt                 # SSL/TLS analysis
└── wpscan.txt              # WordPress scan (if applicable)

    Review Priority

    1. header-score.txt β€” overall security posture at a glance 2. sensitive-files.txt β€” any "FOUND" = critical exposure 3. cors.txt β€” misconfigured CORS = data theft risk 4. titus.txt β€” exposed secrets/API keys 5. ports.txt β€” unexpected open ports 6. nuclei.txt β€” known CVEs 7. subdomains-live.txt β€” forgotten/dev subdomains

    Tool Requirements

    See references/tools.md for install instructions. Scripts skip missing tools gracefully β€” you don't need everything installed to get useful results.

    Wordlists

    See references/wordlists.md. Auto-selects medium wordlists, falls back to smaller if unavailable.

    πŸ’‘ Examples

    # Quick scan (recon, fingerprint, secrets, header scoring, report)
scripts/webscan.sh example.com --quick
    Full scan (all 12 steps)
    
scripts/webscan.sh example.com
    Full scan with JSON output and screenshot
    
scripts/webscan.sh example.com --json --screenshot
    Resume a crashed scan (skips completed steps)
    
scripts/webscan.sh example.com --resume
    Single step
    
scripts/webscan.sh example.com recon
scripts/webscan.sh example.com vulns
    Secrets scan only
    
scripts/titus-web.sh https://example.com

    Output: ~/.openclaw/workspace/recon//

    βš™οΈ Configuration

    | Flag | Description | |------|------------| | --quick | Light scan: recon, fingerprint, secrets, vulns, report | | --full | All steps (default) | | --json | Generate results.json alongside markdown report | | --screenshot | Capture homepage screenshot | | --resume | Skip steps that already have output files |