attack-surface

name	attack-surface
description	Maps every entry point, component, and trust boundary of a target before testing begins prevents missed coverage and prioritizes the highest-value attack paths. Trigger when the user provides a target and wants to know where to start, says "map the attack surface", "what should I test", or "where do I begin", or is starting any engagement after scope-grill is complete.
license	MIT
metadata	{"version":"1.0.0","author":"Rifteo","tags":["pentest","recon","attack-surface","mapping","methodology"]}

Attack Surface Mapper

Before testing individual vulnerabilities, map the full attack surface. Untested components are unfound vulnerabilities. This skill produces a structured map that drives testing coverage.

Process

Phase 1 — Enumerate Entry Points

Systematically identify every place an attacker could interact with the target:

• Web — domains, subdomains, ports 80/443, login pages, API endpoints, file upload, search, export
• APIs — REST, GraphQL, SOAP, WebSocket, mobile API backends
• Auth flows — login, registration, password reset, OAuth/SSO, MFA bypass paths
• Network — open ports, admin interfaces (SSH, RDP, Telnet), VPNs, exposed management panels
• Cloud — S3 buckets, blob storage, exposed functions/lambdas, public AMIs, metadata endpoints
• Third-party integrations — webhooks, OAuth providers, embedded iframes, CDN-served content
• Client-side — JavaScript source, local storage, service workers, postMessage handlers

Phase 2 — Identify Trust Boundaries

Mark where the system transitions between trust levels:

• Unauthenticated → authenticated
• User role → admin role
• External network → internal network
• Client-controlled input → server-side processing

Phase 3 — Tech Stack Fingerprint

For each component, note:

• Language / framework
• Version (if visible)
• Authentication mechanism
• Known CVEs for the version (run check-exploit skill on identified versions)

Phase 4 — Prioritize

Rank attack paths by value. See references/priority-matrix.md.

Output Format

Produce a Surface Map table:

Component	Type	Auth Required	Tech Stack	Priority	Notes
/api/v2/users	REST API	Bearer token	Node.js/Express	High	Returns PII
admin.target.com	Web app	Basic auth	Apache/PHP	Critical	Exposed to internet

Follow with a Recommended Testing Order — ordered list of highest-value targets first.

Rules

• Do not start testing until Phase 1 is complete — partial maps lead to missed coverage
• If the scope is large, timebox Phase 1 and note what was not mapped
• Reference check-exploit for every identified technology version