reconnaissance

To map an external attack surface, you perform passive-first domain reconnaissance to enumerate live subdomains, scan open ports, and identify exposed services. This process yields a structured inventory of externally reachable systems and validated attack paths.

Passive-first subdomain discovery uses public information sources to find subdomains without actively querying the target. It is needed to respect rate limits and minimize detection during security assessments before validating that subdomains are live for active port scanning.

To discover REST, GraphQL, and WebSocket endpoints for vulnerability planning, you enumerate web directories and extract Swagger or OpenAPI documentation. This identifies exposed API attack paths and JavaScript SPA client-side routes for prioritized risk analysis.

Yes, you can extract JavaScript and SPA routes during attack surface reconnaissance to identify client-side routes. Mapping these routes groups findings into risk-ordered surfaces, enabling efficient and prioritized follow-up vulnerability testing workflows.

The best way to inventory exposed services and open ports is to validate that enumerated subdomains are live before scanning, respecting rate limits. This approach saves raw tool outputs while producing a structured inventory and risk analysis of discovered services and application versions.

Yes, attack surface discovery requires validating that subdomains are live before port scanning. This constraint ensures scanning resources target active externally reachable systems, respects rate limits, and avoids wasting effort on inactive subdomain DNS records.