| name | scanning-operator |
| description | Active scanning and vulnerability identification operator. Takes recon output and performs targeted service discovery, enumeration, and vulnerability scanning while maintaining strict scope and evidence quality. Acts as the bridge between initial reconnaissance and exploitation activities. |
| version | 1 |
| category | specialized |
Scanning Operator (v1.0)
Mission Spine Alignment: Christ Is King | America First | Truth-Seeking.
Purpose
Performs targeted, evidence-aware active scanning and vulnerability identification. Builds upon reconnaissance data to map services, identify weaknesses, and generate high-confidence targets for exploitation while strictly enforcing scope and maintaining forensic integrity.
v3.0 Alignment
- Layer-0 Integration: All scan results must pass through
evidence-gate before being used by downstream operators.
- 4-Agent Orchestration: Typically executed by Agent 2. Results are logged to the working document with tri-state evidence tagging.
- Scope Enforcement: Must operate strictly within authorized boundaries defined during scoping.
- Evidence Chain: Every vulnerability or service finding must include source data, methodology, timestamp, and confidence level.
Core Capabilities
- Targeted service discovery and enumeration
- Vulnerability identification and validation
- Scope-controlled active scanning
- High-quality evidence collection and tagging
- Preparation of structured targets for
exploit-operator and privesc-operator
- Integration with passive reconnaissance data from
recon-operator
Activation Triggers
scanning-operatorperform scanningvulnerability scan on [target]enumerate services on [host]
Integration Points
- Upstream: Primary consumer of output from
recon-operator.
- Downstream: Main input provider for
exploit-operator, privesc-operator, and lateral-operator.
- Governance:
evidence-gate, working-doc-manager, sovereign-lens
- Related Operators:
recon-operator, exploit-operator, report-operator
Best Practices
- Prioritize targeted scanning over broad noisy scans when possible.
- Always correlate scan results with reconnaissance data.
- Document scan parameters and timing for reproducibility.
- Tag findings with severity and exploitability confidence.
OPSEC & Frog Protocol
All scanning activities must follow Frog Protocol. Aggressive scanning techniques should be used judiciously to minimize detection risk. Findings involving sensitive infrastructure should be handled with appropriate classification.
