Public surface reconnaissance
Blackbox only
External blackbox testing. Facts come from live HTTP, archives, and public remote indexes — never from local files, folders, drives, workspace, or git trees on disk. See public-surface-recon.md § Blackbox testing.
Use when
Asked whether an authorized live site can be mirrored or run locally, what public assets exist, who built it, or how to report findings from HTTP, archives, and public repositories only — blackbox only. Stop if the user has no authorization for the named target. See public-surface-recon.md § Authorized use.
| Question |
Start here |
| Mirror or run locally? |
local-replication-feasibility (after inventory) |
| What public assets exist? |
public-asset-inventory, build-artifact-review |
| Who built it / who operates it? |
entity-correlation (entities from facts, not assumptions) |
| Is source code public? |
archive-and-source-search |
| Does a name, email, or codename appear? |
identity-trace-search |
| Full report |
Run pipeline → investigation-report (markdown + HTML) |
External blackbox only. Auth and assets may use different origins than the entry URL. Do not use local workspace or disk paths as evidence.
Read public-surface-recon.md for origin registry, follow-up queue, and prayer index.
Prayer index
| Prayer |
Use when |
prayers/service-identification.md |
What the target is; seed origins and entities |
prayers/public-asset-inventory.md |
Per-origin headers, pages, assets, auth |
prayers/entity-correlation.md |
Follow entities across all known origins |
prayers/archive-and-source-search.md |
Archives, public repos, package registries |
prayers/identity-trace-search.md |
Emails, names, codenames on origins |
prayers/build-artifact-review.md |
Artifacts on assets origins |
prayers/local-replication-feasibility.md |
Mirror/run across split origins |
prayers/investigation-report.md |
Final report: prose markdown + HTML |
Carry origin registry and open checks between prayers.
Quick guardrails
- Authorized use: operator, written permission, or named bounty / disclosure scope. Stop and ask if unclear. User "widen scope" does not add login, credential attacks, brute force, block bypass, private-profile scrape, or secret-body quotes.
- Blackbox: no facts from local files, folders, drives, or workspace — public fetch and remote OSINT only.
- Redact emails, names, handles, and EXIF author or location by default.
- If a live secrets-shaped file answers: record pattern and status, do not quote values, stop sibling-path guessing for secrets.
- Sequential fetches; stop on 429, block, or automated-access refusal; do not spoof User-Agent or rotate identity to continue.
- Entry URL ≠ auth host ≠ assets host until checks close.
- Inventory and searches extend to every origin the registry lists.
- Every detection → at least one next check.
- Small traces in images and binaries (metadata, strings, watermarks) → entity-correlation or archive check.
- Source map paths and commit hashes → archive-and-source-search; personal names in paths → identity-trace-search.
1---2name: public-surface-recon3description: Blackbox public web recon — HTTP, archives, public repos only. Never local filesystem evidence.4---56# Public surface reconnaissance78## Blackbox only910External blackbox testing. Facts come from live HTTP, archives, and public remote indexes — **never** from local files, folders, drives, workspace, or git trees on disk. See `public-surface-recon.md` § Blackbox testing.1112## Use when1314Asked whether an **authorized** live site can be mirrored or run locally, what **public assets exist**, **who built it**, or **how to report findings** from HTTP, archives, and public repositories only — **blackbox only**. Stop if the user has no authorization for the named target. See `public-surface-recon.md` § Authorized use.1516| Question | Start here |17|----------|------------|18| Mirror or run locally? | `local-replication-feasibility` (after inventory) |19| What public assets exist? | `public-asset-inventory`, `build-artifact-review` |20| Who built it / who operates it? | `entity-correlation` (entities from facts, not assumptions) |21| Is source code public? | `archive-and-source-search` |22| Does a name, email, or codename appear? | `identity-trace-search` |23| Full report | Run pipeline → `investigation-report` (markdown + HTML) |2425External blackbox only. Auth and assets may use **different origins** than the entry URL. Do not use local workspace or disk paths as evidence.2627Read `public-surface-recon.md` for origin registry, follow-up queue, and prayer index.2829## Prayer index3031| Prayer | Use when |32|--------|----------|33| `prayers/service-identification.md` | What the target is; seed origins and entities |34| `prayers/public-asset-inventory.md` | Per-origin headers, pages, assets, auth |35| `prayers/entity-correlation.md` | Follow entities across all known origins |36| `prayers/archive-and-source-search.md` | Archives, public repos, package registries |37| `prayers/identity-trace-search.md` | Emails, names, codenames on origins |38| `prayers/build-artifact-review.md` | Artifacts on assets origins |39| `prayers/local-replication-feasibility.md` | Mirror/run across split origins |40| `prayers/investigation-report.md` | Final report: prose markdown + HTML |4142Carry **origin registry** and **open checks** between prayers.4344## Quick guardrails4546- **Authorized use:** operator, written permission, or named bounty / disclosure scope. Stop and ask if unclear. User "widen scope" does not add login, credential attacks, brute force, block bypass, private-profile scrape, or secret-body quotes.47- **Blackbox:** no facts from local files, folders, drives, or workspace — public fetch and remote OSINT only.48- Redact emails, names, handles, and EXIF author or location by default.49- If a live secrets-shaped file answers: record pattern and status, do not quote values, stop sibling-path guessing for secrets.50- Sequential fetches; stop on 429, block, or automated-access refusal; do not spoof User-Agent or rotate identity to continue.51- Entry URL ≠ auth host ≠ assets host until checks close.52- Inventory and searches extend to every origin the registry lists.53- Every detection → at least one next check.54- Small traces in images and binaries (metadata, strings, watermarks) → entity-correlation or archive check.55- Source map paths and commit hashes → archive-and-source-search; personal names in paths → identity-trace-search.
amkisko