| name | mapping-attack-surface |
| description | Map and prioritize the attack surface of an authorized black-box web target before testing it - enumerate hosts, endpoints, parameters, auth flows, and technologies, then order them by where bugs actually live. Use at the start of an in-scope engagement or bug-bounty target when you have a URL/app but no source, and need a systematic surface inventory instead of poking random endpoints; when you need to know what to test first. Enforces a scope gate and produces a prioritized surface inventory that feeds the vuln-class skills. |
| license | MIT |
Mapping attack surface (black-box)
You can't test what you haven't found, and you'll waste the engagement testing
low-value surface first. Recon is the discipline of turning "here's a URL" into a
prioritized inventory of everything that takes input, ordered by where bugs live.
This skill is the front of the black-box workflow; per-class hunting skills act on
its output.
Scope gate - before anything else
Establish and write down scope first, and check every action against it:
- Record the authorization: which hosts/domains/apps are in scope, which are
explicitly out, the rules (rate limits, no-DoS, no social engineering, test-
account only), and the reporting channel. Keep it where you'll re-read it.
- Check every request against scope before sending it. A wildcard in a
program's scope is not permission to hit a third party's system that happens to
be reachable.
- Passive before active; low-impact before high. Prefer observation over
probing until you've confirmed a target is in scope and the action is allowed.
- Never run destructive or state-changing actions (delete, mass-write,
account takeover attempts) without explicit authorization for them.
