attack-surface-discovery

Web application reconnaissance is automated by an 18-phase pipeline that executes crawling, fuzzing, and endpoint enumeration against live targets to map the attack surface. It replaces manual probing with a structured workflow producing traceable JSON and Markdown reports.

Penetration testing for broken access controls is supported through multi-role access testing. The Skill profiles authenticated sessions and classifies responses across roles to surface broken access controls and IDOR-shaped anomalies during the reconnaissance pipeline.

Automated attack surface discovery requires better-sqlite3, cheerio, and playwright dependencies to crawl live targets and extract endpoint data. These enable headless browser interaction, HTML parsing, and local database storage for reconnaissance artifacts.

The best way to map user journeys and classify parameters is using an autonomous pipeline with deterministic quality gates. It profiles application flows, classifies endpoint parameters, and validates findings through a zero-context Final Judge reviewer.

An autonomous security scanning pipeline ensures completeness by applying deterministic per-phase quality gates and a Quality Reviewer subagent. A zero-context Final Judge validates findings, while artifact-first provenance maps every discovered endpoint to its source.

Attack surface discovery can find secrets hidden in JavaScript bundles during the crawling phase. The pipeline enumerates reachable endpoints, analyzes JavaScript files, and maps user journeys to produce a structured reconnaissance report.