Reconnaissance maps the target's attack surface. ShellGPT turns natural-language intent into the
right recon command and, in --code mode, can generate supporting tooling on demand.
⚠️ Only enumerate assets you own or are authorized to test — see ../DISCLAIMER.md.
sgpt --shell "Use Amass to enumerate subdomains for example.com"
# -> amass enum -d example.com
sgpt --shell "Find subdomains of example.com using Sublist3r"
# -> sublist3r -d example.comWith the recon role (recommended — keeps output enumeration-only):
sgpt --role pentest-recon --shell "enumerate subdomains of example.com"sgpt --shell "List all DNS records for example.com using dig"
# -> dig example.com ANY +noall +answer
sgpt --shell "Attempt a DNS zone transfer for example.com"
# -> dig AXFR @8.8.8.8 example.comA successful zone transfer (rare, and a finding in itself) dumps the entire zone — note it and move on.
Certificate Transparency logs are a passive goldmine for subdomains:
sgpt --shell "Query crt.sh for subdomains of example.com using curl and jq"
# -> curl -s 'https://crt.sh/?q=%25.example.com&output=json' | jq -r '.[].name_value' | sort -usgpt --shell "Show WHOIS registration details for example.com"
# -> whois example.comWhen no single tool fits, have ShellGPT write the helper:
sgpt --code "Write a Python script for port scanning"The generated scanner is a good starting point; a hardened, threaded version is included at
scripts/helpers/port_scanner.py.
The scripts/recon.sh harness chains the common recon tasks above, asks
for authorization first, and presents each generated command behind the Execute/Describe/Abort
gate:
cd scripts
./recon.sh example.com- Subdomains (Amass, Sublist3r, crt.sh) — deduplicated and resolved
- DNS records (A, AAAA, MX, NS, TXT) and zone-transfer attempt
- WHOIS / registrar / ASN ownership
- Technology fingerprint of live hosts (feeds the scanning phase)