recon

Subdomain enumeration and attack surface mapping are automated by running a pipeline that performs passive OSINT, HTTP probing, and active port scanning to discover live hosts and infrastructure details. It identifies cloud assets, leaked secrets, and technology stacks for comprehensive threat landscape analysis.

Passive reconnaissance gathers target intelligence using OSINT sources without directly interacting with the target's systems. You need it during vulnerability assessment to discover subdomains, cloud assets, and leaked secrets before launching active scans, mapping to MITRE ATT&CK Reconnaissance tactics.

Yes, you need python3, subfinder, httpx, amass, nmap, theHarvester, shodan, and masscan installed. These dependencies enable the Skill to execute active port scanning, subdomain discovery, and cloud asset identification across the target's external-facing infrastructure.

The best way to identify cloud assets and leaked secrets is using an automated reconnaissance pipeline that combines OSINT gathering with active scanning. This approach maps the target's digital footprint and identifies potential entry points and vulnerabilities before an attack.

Yes, Shodan and masscan are integrated to support external infrastructure port scanning. Shodan queries OSINT for cloud assets and exposed services, while masscan performs high-speed active port scanning to identify open ports across the target's attack surface.

HTTP probing identifies live hosts by sending requests to discovered subdomains to verify responsive web servers and extract technology stacks. This filters out dead DNS records, providing an accurate inventory of external-facing assets for vulnerability assessment.