skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

implementing-attack-surface-management

Implements external attack surface management using Shodan, Censys, and ProjectDiscovery tools for asset discovery and exposure scoring.

954|172|Updated Mar 13, 2026
Search Tags:#reconnaissance#attack surface management#subfinder#censys#exposure scoring#Nuclei#Shodan
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill implementing-attack-surface-management
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: implementing-attack-surface-management
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/offensive-security/implementing-attack-surface-management
Command: npx skills add https://github.com/xalgord/xalgorix --skill implementing-attack-surface-management

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires shodan, censys, requests.

What problem does it solve?

Organizations often lack visibility into their internet-facing assets, missing exposed services, forgotten subdomains, and unpatched vulnerabilities that attackers can find first. This Skill builds a complete external attack surface management (EASM) pipeline that discovers, fingerprints, and scores every exposed asset.

Core Features & Use Cases

  • Multi-Source Asset Discovery: Enumerate subdomains with subfinder and Amass, then enrich results with Shodan and Censys queries for exposed services, certificates, and known CVEs.
  • Service Fingerprinting & Vulnerability Scanning: Probe live hosts with httpx for technology detection and run Nuclei templates filtered by severity or category.
  • Weighted Exposure Scoring: Prioritize assets using a 0-100 scoring algorithm based on OWASP attack surface analysis and the Relative Attack Surface Quotient (RSQ).
  • Use Case: A security team starting a pentest engagement runs the full pipeline against a target domain to produce a scored JSON report of live hosts, open services, and critical findings before any manual testing begins.

Quick Start

Ask the agent to run a full attack surface scan against example.com using your Shodan and Censys API keys and output a scored JSON report.

Frequently Asked Questions about implementing-attack-surface-management

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enumerate subdomains with subfinder and Amass?▼

Run subfinder -d example.com -all -recursive for passive enumeration across dozens of sources, then amass enum -d example.com -passive for deeper discovery. Merge and deduplicate both outputs with sort -u before probing live hosts.

How do I find exposed services with Shodan and Censys?▼

Use the Shodan Python API to search by organization, hostname, or SSL certificate subject, and the CensysHosts API to query certificate common names. Both return IPs, open ports, services, and associated CVEs for discovered assets.

What API keys are required for attack surface management?▼

You need a Shodan API key (free tier allows 100 queries per month) and a Censys API ID and Secret (free tier available). ProjectDiscovery tools like subfinder, httpx, and nuclei are open source and require no keys.

How does the exposure scoring algorithm prioritize assets?▼

The algorithm computes a 0-100 weighted score based on OWASP attack surface analysis and the Relative Attack Surface Quotient. It factors in open ports weighted by service risk, CVSS scores of known vulnerabilities, technology age, exposure level, and data sensitivity.

Why do Nuclei scan results contain false positives?▼

A single template hit is a lead, not a confirmed finding. Confirm by manually reproducing the request and response, verifying the matched string reflects the actual vulnerability rather than an error page, and re-running to rule out flapping.

Can I scan assets outside my authorized scope?▼

No. Shared CDN and SaaS IPs such as Cloudflare, AWS, or GitHub Pages frequently fall outside authorization even when the hostname matches. Confirm the underlying IP and organization sit within the signed scope before any active scanning.

Related Skills

Explore More Software Engineering Skills→
jwm-axonijwm-axoni
3

recon

Map network infrastructure via passive and authorized active reconnaissance.

Community
Advanced
noname300989noname300989

xbow-integration

Orchestrate open-source security tools to discover and confirm exploitable vulnerabilities.

Community
Advanced
samuelmukotisamuelmukoti

domain-intel

Discover passive domain intelligence using Python's standard library.

Community
Intermediate
Liberty91LTDLiberty91LTD
15

lookup-shodan

Query Shodan to gather host reconnaissance data for IPs and domains.

Official
Intermediate