scan-fase-19

Map external and internal attack surfaces with infrastructure reconnaissance.

Updated Mar 11, 2026

Search Tags:#reconnaissance #infrastructure #dns #tls #port-scan #subdomain-enum #cdn-waf-detection

Ready to run

npx skills add https://github.com/ricardoo022/PentestAI-with-claude-code --skill scan-fase-19

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: scan-fase-19
Source: https://github.com/ricardoo022/PentestAI-with-claude-code/tree/main/.claude/skills/scan-fase-19
Command: npx skills add https://github.com/ricardoo022/PentestAI-with-claude-code --skill scan-fase-19

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill enables security teams to discover and assess infrastructure-level attack surfaces beyond the application layer, revealing misconfigurations, exposed services, and weak cryptography that could be exploited.

Core Features & Use Cases

Subdomain enumeration: fingerprint and map subdomains using tools like subfinder and amass.
DNS & TLS analysis: assess DNS configurations (SPF/DMARC/TXT) and certificate validity, including zone transfers and TLS posture.
Network ingress discovery: perform port scanning and service fingerprinting to identify exposed infrastructure services.
CDN/WAF detection: identify content delivery networks and web application firewall presence, with bypass considerations.
Autonomous exploration: apply threat modeling (STRIDE) and correlate data to uncover hidden infrastructure risks.

Quick Start

Invoke with /scan-fase-19 {url} after domain extraction and basic reconnaissance to start infrastructure discovery.

Frequently Asked Questions about scan-fase-19

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform comprehensive infrastructure reconnaissance on an external network attack surface?▼

Infrastructure reconnaissance maps an organization's external and internal attack surface by fingerprinting technologies, discovering exposed services, and assessing weak cryptographic configurations across cloud, on-premise, and hybrid environments.

What is the best way to enumerate subdomains and assess DNS and TLS posture?▼

Subdomain enumeration maps external assets using tools like subfinder and amass, while DNS and TLS analysis evaluates SPF, DMARC, and TXT records alongside certificate validity and zone transfer vulnerabilities.

How does CDN and WAF detection work during network ingress discovery?▼

CDN and WAF detection identifies content delivery networks and web application firewalls during port scanning and service fingerprinting, highlighting exposed infrastructure services and potential bypass considerations.

Can I apply STRIDE threat modeling to correlate infrastructure reconnaissance findings?▼

Yes, autonomous exploration applies STRIDE threat modeling to correlate DNS, TLS, and port scanning data, uncovering hidden infrastructure risks and extracting IOCs for remediation.

Does infrastructure reconnaissance support hybrid cloud and on-premise environments?▼

Yes, infrastructure reconnaissance assesses misconfigurations and exposed services across cloud, on-premise, and hybrid environments, identifying weak cryptography and fingerprinting technologies for security teams.

When should I not use broad port scanning for attack surface assessment?▼

Broad port scanning and service fingerprinting may trigger CDN or WAF alerts; security teams must consider bypass strategies and focus on targeted network ingress discovery to avoid detection.