recon

Attack surface mapping is performed by gathering DNS records, certificate transparency subdomains, and public repo data to produce an actionable structured recon report. This process organizes scattered external footprint information into prioritized risks for authorized testing.

Passive reconnaissance collects external footprint data without directly probing the target, using methods like WHOIS, search dorking, and Wayback historical endpoint review. Use it when planning authorized penetration tests or bug bounty programs to gather intelligence while minimizing detection.

Yes, target-scoped active recon includes authorized port scanning, service version enumeration, web content discovery, and TLS cipher checks. This active probing prioritizes real attack vectors but requires explicit authorization boundaries before execution.

TLS misconfiguration checks are conducted during authorized active probing by testing ciphers and certificates across discovered subdomains. Certificate transparency logs gathered during passive recon provide the initial subdomain list for these TLS validations.

Reporting attack surface findings requires correlating passive OSINT and active probing results into a structured report with prioritized risks. The generated output provides recommended next steps aligned to the engagement scope for decision-making.

Yes, generating a structured recon report requires an entry-point SKILL.md YAML frontmatter containing the name and description. This frontmatter enforces scope and authorization boundaries before mapping the external footprint.