recon-and-enumeration

Subdomain enumeration and port scanning are automated through a phase-driven workflow that collects passive OSINT, enumerates DNS records, and runs active port discovery using rustscan and nmap to map the target attack surface. You provide a target and scope to generate the inventory.

Mapping an organization's attack surface requires inventorying endpoints, services, and technologies across web, network, and cloud surfaces. This is achieved by combining passive OSINT collection with active web enumeration and network service fingerprinting for SMB, SNMP, and LDAP protocols.

Yes, rustscan and nmap are integrated into a validated tool workflow where rustscan handles rapid active port discovery and nmap performs detailed service fingerprinting. This combined approach ensures robust recon data with clear validation and fallback protocols.

SPA discovery and client-side routing analysis are explicitly supported to map modern web applications. The workflow identifies single-page application architectures and analyzes client-side routes to uncover hidden entry points during web enumeration.

Enumerating exposed network services like SMB and SNMP is handled by the network service enumeration phase, which fingerprints exposed services to reveal potential entry points. This follows the active port discovery phase in the structured reconnaissance workflow.

Passive OSINT collection and DNS enumeration are required before active port scanning to identify the target surface without direct interaction. This foundational phase discovers subdomains and technologies, providing the scope necessary for subsequent rustscan and nmap workflows.