pentest-recon-attack-surface

name	pentest-recon-attack-surface
description	White-box attack surface mapping — correlate external scans, browser exploration, and source code into structured endpoint inventory, role architecture, and authorization vulnerability candidates.

Pentest Recon Attack Surface

Purpose

Perform comprehensive attack surface mapping by correlating three data sources: external network scans, authenticated browser exploration, and source code analysis. Produces a structured endpoint inventory with authorization metadata, role/privilege architecture, and prioritized authorization vulnerability candidates for downstream code review and exploitation.

Prerequisites

Authorization Requirements

• Written authorization with explicit scope for reconnaissance and source code access
• Source code access to the target application (white-box engagement)
• Test accounts at every privilege level (anonymous, user, admin, service)
• Network scan approval — confirm acceptable scan intensity with target owner

Environment Setup

• nmap, subfinder, httpx, whatweb for external reconnaissance
• Playwright with authenticated browser contexts
• katana or gospider for web crawling
• ffuf for content discovery
• semgrep and ripgrep for source code analysis
• Access to deployment configs (Dockerfile, docker-compose, k8s manifests)

Core Workflow

1. Technology Fingerprinting: Run whatweb + httpx to identify frameworks, languages, server versions, WAF presence, and response header signatures.
2. External Scan Correlation: Execute nmap service scan + subfinder subdomain enumeration. Cross-reference discovered services against deployment configs (docker-compose ports, k8s service definitions) to identify exposed vs internal-only services.
3. : Authenticated Playwright crawl at each privilege level. Capture all XHR/fetch requests, form submissions, WebSocket connections, and dynamic route transitions. Record request/response pairs with auth context.