Plan an assessment with Recon and Planner

Recon and Planner write plans; they do not touch the target. Set the scope first — both tools check the target against it.

Recon

Open Recon under Red Team, enter an in-scope target and what you want to learn. Oyster writes a reconnaissance plan: what to look at, in what order, and which public sources and techniques apply. You carry it out yourself, with your own tools.

Planner

Open Planner, enter the in-scope target and your objective — for example “authentication and session handling of the login flow”. Oyster writes a structured test plan grounded in established methodology: phases, the checks in each, what evidence to capture, and what a finding would look like.

Work through the plan

1. Review the plan against your rules of engagement, and remove anything they do not allow.
2. Test with your own tools, within your authorization.
3. Capture evidence as you go: requests and responses, output, screenshots.
4. Record each issue as a finding. See Findings and reports.

Example requests

• “Draft a test plan for the login flow of my authorized target app.example.com, focused on authentication and session handling.”
• “What should a reconnaissance plan for our in-scope staging API cover, and what evidence should I keep?”
• “Turn this finding into a remediation with concrete code changes and a test that confirms the fix.”