asset-discovery
Probe subdomain list with httpx/dnsx/naabu to identify live hosts, open ports, status codes, titles, and basic fingerprints. Use after subdomain-enum produces a sub list. Output feeds into fingerprinting and content discovery.
npx skills add majiayu000/claude-skill-registry --skill 05-asset-discovery --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Asset Discovery (Live Host Probing) > 1000 subdomains in → 80 living web apps + 14 open APIs out. ## When to invoke **Trigger phrases:** - "probe with httpx" - "find live hosts" - "which subs are alive" - "port scan in-scope assets" ## Pipeline overview ``` subdomains.txt │ ▼ ┌─────────┐ │ dnsx │ resolve to A/CNAME/MX (drop dead ones) └────┬────┘ │ ▼ ┌──────────┐ │ naabu │ port scan (top 1000 + custom) └─────┬────┘ │ ▼ ┌───────┐ │ httpx │ HTTP probe — status, title, tech, headers └───┬───┘ │ ▼ live.txt (with rich metadata) ``` ## Step-by-Step Workflow ### 1. DNS resolution (filter dead subs) ```bash TARGET="target.com" OUT="loot/$TARGET" # dnsx — resolve A, CNAME, drop unresolvable cat "$OUT/subs/in-scope.txt" | dnsx -silent -a -resp > "$OUT/resolved.txt" # Just the hostname (no IPs): cat "$OUT/subs/in-scope.txt" | dnsx -silent > "$OUT/alive-dns.txt" ``` ### 2. Port scanning ```bash # naabu — top 1000 ports, fast SYN scan (requires root for SYN; non-root falls back to connect) naabu -list "$OUT/alive-dns.txt" -top-ports 1000 -rate 5000 -silent -o "$OUT/ports.txt" # Or specific ports common for web targets naabu -list "$OUT/alive-dns.txt" -p 80,443,8080,8443,3000,5000,8000,8888,90
- When to invoke
- Pipeline overview
- Step-by-Step Workflow
- 1. DNS resolution (filter dead subs)
- 2. Port scanning
- 3. HTTP probing (the goldmine)
- 4. Extract focus targets
- 5. Screenshot (visual triage)
- Output structure
- Quick filters
- High-value patterns to highlight
- Cross-references
- Common pitfalls
- Speed tuning
dnsx — resolve A, CNAME, drop unresolvable cat "$OUT/subs/in-scope.txt" | dnsx -silent -a -resp > "$OUT/resolved.txt" Just the hostname (no IPs): cat "$OUT/subs/in-scope.txt" | dnsx -silent > "$OUT/alive-dns.txt" naabu — top 1000 ports, fast SYN scan (requires root for SYN; non-root falls back to connect) naabu -list "$OUT/alive-dns.txt" -top-ports 1000 -rate 5000 -silent -o "$OUT/ports.txt" Or specific ports common for web targets naabu -list "$OUT/alive-dns.txt" -p 80,443,8080,8443,3000,5000,8000,8888,9000,9443 \ For comprehensive (slow): all ports naabu -list "$OUT/alive-dns.txt" -p - -rate 2000 -silent -o "$OUT/all-ports.txt"
What does the asset-discovery skill do?
Probe subdomain list with httpx/dnsx/naabu to identify live hosts, open ports, status codes, titles, and basic fingerprints. Use after subdomain-enum produces a sub list. Output feeds into fingerprinting and content discovery.
How do I install it?
Run `npx skills add majiayu000/claude-skill-registry --skill 05-asset-discovery --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From majiayu000/claude-skill-registry, a repository with 534 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.