| name | attack-surface |
| description | Maps every entry point, component, and trust boundary of a target before testing begins prevents missed coverage and prioritizes the highest-value attack paths. Trigger when the user provides a target and wants to know where to start, says "map the attack surface", "what should I test", or "where do I begin", or is starting any engagement after scope-grill is complete. |
| license | MIT |
| metadata | {"version":"1.0.0","author":"Rifteo","tags":["pentest","recon","attack-surface","mapping","methodology"]} |
Attack Surface Mapper
Before testing individual vulnerabilities, map the full attack surface. Untested components are unfound vulnerabilities. This skill produces a structured map that drives testing coverage.
Process
Phase 1 — Enumerate Entry Points
Systematically identify every place an attacker could interact with the target:
- Web — domains, subdomains, ports 80/443, login pages, API endpoints, file upload, search, export
- APIs — REST, GraphQL, SOAP, WebSocket, mobile API backends
- Auth flows — login, registration, password reset, OAuth/SSO, MFA bypass paths
- Network — open ports, admin interfaces (SSH, RDP, Telnet), VPNs, exposed management panels
- Cloud — S3 buckets, blob storage, exposed functions/lambdas, public AMIs, metadata endpoints
- Third-party integrations — webhooks, OAuth providers, embedded iframes, CDN-served content
- Client-side — JavaScript source, local storage, service workers, postMessage handlers
Phase 2 — Identify Trust Boundaries
Mark where the system transitions between trust levels:
- Unauthenticated → authenticated
- User role → admin role
- External network → internal network
- Client-controlled input → server-side processing
Phase 3 — Tech Stack Fingerprint
For each component, note:
- Language / framework
- Version (if visible)
- Authentication mechanism
- Known CVEs for the version (run
check-exploit skill on identified versions)
Phase 4 — Prioritize
Rank attack paths by value. See references/priority-matrix.md.
Output Format
Produce a Surface Map table:
| Component | Type | Auth Required | Tech Stack | Priority | Notes |
|---|
/api/v2/users | REST API | Bearer token | Node.js/Express | High | Returns PII |
admin.target.com | Web app | Basic auth | Apache/PHP | Critical | Exposed to internet |
Follow with a Recommended Testing Order — ordered list of highest-value targets first.
Rules
- Do not start testing until Phase 1 is complete — partial maps lead to missed coverage
- If the scope is large, timebox Phase 1 and note what was not mapped
- Reference
check-exploit for every identified technology version
