mcpField
A
attack-surface-recon

attack-surface-recon

github.com/securityskillsSecurity0427 installsUpdated 9w ago
Repository

About attack-surface-recon

Attack Surface Recon is a security reconnaissance method for mapping an organization’s external attack surface from public sources. Intended for authorized assessors, it covers domains, subdomains, exposed services, credential and code leaks, and brand risks, producing a risk-ranked asset inventory.

Key features

  1. 01Expand domains through certificate, ASN, and WHOIS data
  2. 02Enumerate subdomains passively and actively
  3. 03Probe live services and fingerprint technologies
  4. 04Scan exposed ports and takeover risks
  5. 05Check public credential, code, and storage leaks
  6. 06Compile a risk-ranked asset inventory

Use cases

  1. 01Build an external asset inventory for an authorized assessment
  2. 02Find exposed admin panels or databases
  3. 03Investigate leaked credentials and sensitive public code
  4. 04Identify takeover-prone records and plan monitoring

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/securityskills/skills --skill attack-surface-recon

After installing, type/attack-surface-reconin Claude Code to confirm it loaded.

Details

From the project README

Attack Surface Recon

Build a complete external attack-surface picture from public sources.

1. Root Domain Discovery

  • Start from known brands/domains; expand via certificate transparency (crt.sh), ASN lookups, WHOIS reverse lookups, acquisition history
  • Identify cloud ranges: enumerate owned netblocks (bgp.he.net, ipinfo)

2. Subdomain Enumeration

  • Passive sources: CT logs, DNS datasets (SecurityTrails-style), web archives
  • Active: DNS bruteforce, permutation generation (alterations of known hosts: -dev, -staging, -old)
  • Resolve; probe HTTP(S) for live services; fingerprint technologies (httpx/wappalyzer)

3. Exposed Services

  • Port scan in-scope IPs (top ports minimum, full range on high-value hosts)
  • Flag: exposed admin panels, databases (3306/5432/27017), RDP/SMB, Redis/Memcached, Kubernetes API, VPN portals, file shares
  • Takeover checks: dangling CNAMEs pointing at deprecated cloud services

4. Credential and Code Leaks

  • Breach data for corporate domains (report presence; never view more than proof)
  • Public code search (GitHub/gists) for org domains, tokens, internal hostnames in commits
  • Exposed storage: open S3 buckets/azure blobs matching org naming patterns

5. People and Brand

  • Employee enumeration via LinkedIn for phishing-simulation scoping (policy permitting)
  • Lookalike domains registered recently (typosquats), abuse of brand in app stores

Rules

  • Passive sources preferred; active scanning only within authorization
  • Found leaked credentials: report immediately, do not log in with them

Output

Ranked asset inventory: exposed services by risk, credential leak notifications, takeover-prone records, and monitoring recommendations.

Comments

Markdown supported