mcpField
P
pentest-recon-surface-analysis

pentest-recon-surface-analysis

github.com/crtvrffnrtSecurity469 installsUpdated 5w ago
Repository

About pentest-recon-surface-analysis

pentest-recon-surface-analysis is a security testing skill for modeling targets and discovering exposed assets, interfaces, and entry points. It organizes deduplicated findings and prioritizes focused validation targets for downstream testing.

Key features

  1. 01Model interfaces and trust boundaries
  2. 02Enumerate relevant attack surfaces
  3. 03Deduplicate discovered assets
  4. 04Prioritize validation targets
  5. 05Record evidence and unknowns
  6. 06Hand off testable targets

Use cases

  1. 01Inventory exposed services and endpoints
  2. 02Map identity contexts and entry points
  3. 03Prioritize externally reachable paths
  4. 04Prepare targets for focused validation

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/crtvrffnrt/skills --skill pentest-recon-surface-analysis

After installing, type/pentest-recon-surface-analysisin Claude Code to confirm it loaded.

Details

From the project README

Recon & Surface Analysis

Use When

  • The owner phase is target modeling, endpoint discovery, service enumeration, technology fingerprinting, vhost discovery, subdomain enumeration, or control-plane mapping.
  • The next step needs a deduplicated inventory and prioritized validation targets.

Handoff Criteria

  • Hand off to pentest-web-enumeration when live HTTP(S) services need application fingerprinting, vhost discovery, route/JS/API enumeration, focused content discovery, or Nuclei-led early checks.
  • Hand off to mapper, authz, input/protocol, XSS, business-logic, OOB, CVE, exploit, or reporting workflows when the main blocker becomes focused validation or delivery.

Output Schema

  • Surface inventory: asset, interface, auth state, confidence
  • Entry-point matrix: input, trust boundary, initial risk hypothesis
  • Prioritized next tests: ordered by likely impact and test cost

Instructions

  1. Build an explicit target model first: interfaces, trust boundaries, and identity contexts.
  2. Enumerate only what is necessary to expose actionable attack paths.
  3. Normalize findings into a deduplicated inventory before deeper testing.
  4. Label each surface with attacker preconditions and probable abuse class.
  5. Mark unknowns that block progression and propose the minimum test to resolve each.
  6. Hand off precise, testable targets to downstream skills.

Should Do

  • Keep reconnaissance hypothesis-driven, not tool-driven.
  • Capture reproducible evidence for each discovered surface.
  • Prioritize externally reachable and privilege-sensitive paths.
  • Use up to two controlled pivots per phase; each pivot needs an expected signal and stop condition.
  • Treat scanner output as a lead until cross-checked with direct evidence.

Tip: Fuzzing for Virtual Hosts with FFUF

Discover assets not listed in DNS by testing different Host header values. FFUF is the ideal tool for this speed-efficient enumeration.

Quick Guide
  1. Optimize: Use small wordlists and fast scans to ensure the agent doesn't get stuck.
  2. Execute: ffuf -u $TARGET -H "Host: FUZZ.$TARGET" -w /path/to/small_wordlist
  3. Filter: Identify live hosts by filtering unique response sizes or status codes (e.g., -fs [size] or -mc 200).

Comments

Markdown supported