Web Surface

Web Surface Enumeration

Sub-skill of offensive-osint. Load osint-methodology for pipeline and triage context. Authorized targets only.

BEHAVIORAL CONTRACT

When triggered: Web surface enumeration, Swagger/OpenAPI/GraphQL discovery, endpoint probing, email security analysis, vendor fingerprinting, documentation leak hunting, or subdomain takeover assessment is needed.

Execute:

1. For each alive webapp, probe the Swagger/OpenAPI paths (§1) and GraphQL paths (§2).
2. Check high-risk ports (§3) against Shodan/naabu results.
3. Audit security headers (§4) — escalate per sensitive-path rules.
4. Run always-on HTTP checks (§5) with listed match logic.
5. Probe JS guess-paths (§6) and extract endpoints via regex tiers (§7).
6. Check for internal-host leakage (§8) in JS bodies, sourcesContent, APK strings.
7. Audit email security posture (§9): parse SPF/DMARC/DKIM/BIMI/MTA-STS/TLS-RPT/DNSSEC, map severity, infer SaaS tenants from TXT records, extract DMARC vendor and MX-based IdP.
8. Fingerprint vendor products (§10) — cross-reference with CISA KEV for severity escalation.
9. Assess subdomain takeover risk (§11) using provider fingerprints.
10. Enumerate cloud buckets (§12) using permutation arsenal.
11. Check documentation/wiki leak paths (§13).
12. Query API endpoints (§14) for Wayback CDX, Postman workspace search, and Stack Exchange OSINT.
13. For each finding, assign severity per the inline tables and emit per osint-methodology §3 schema.

Output: Per-finding results using osint-methodology §3 schema.

Severity rules: Swagger/OpenAPI without auth = HIGH. GraphQL introspection without auth = HIGH. Vendor product matching KEV CVE = CRITICAL. Missing HSTS on login page = HIGH (escalated from MEDIUM).

Gating rules: Authorized targets only. Detection-aware: if 429s or WAF blocks appear during probing, follow osint-methodology §6.4 back-off ladder.

Chain to: Load secrets-and-dorks for secret scanning of discovered JS/API specs. Load analysis-and-reporting for endpoint interest scoring (score >= 70 gets attack-path hint). Feed discovered email security gaps to people-breach-intel.

1. Swagger / OpenAPI Discovery — 28 Paths

Probe each on every alive webapp. GET (or HEAD if rate-limited).

swagger.json           swagger.yaml
swagger/v1/swagger.json    swagger/v2/swagger.json
swagger-ui.html        swagger-ui/
swagger-resources      api-docs
api-docs.json          api/swagger
api/swagger.json       api/swagger-ui.html
api/v1/swagger.json    api/v2/swagger.json
api/v3/api-docs        v2/api-docs
v3/api-docs            openapi.json
openapi.yaml           openapi/v1
openapi/v3             docs
redoc                  rapidoc
api/docs               api/documentation
api/swagger.yaml       .well-known/openapi

Reachable Swagger/OpenAPI spec without auth → HIGH LEAKY_API_SPEC.

2. GraphQL Discovery — 13 Paths

graphql    graphiql    api/graphql    v1/graphql    v2/graphql
query      api/query   gql            altair
playground subscriptions graphql/console api/v1/graphql

Standard introspection POST body:

{
  "operationName": "IntrospectionQuery",
  "query": "query IntrospectionQuery { __schema { types { name kind fields { name type { name kind } } } queryType { name } mutationType { name } subscriptionType { name } } }"
}

• Introspection without auth → HIGH OPEN_GRAPHQL_API.
• Field-suggestion enumeration (server "did you mean" on typo'd fields) → MEDIUM (re-derive partial schema even when introspection is disabled).
• Batched queries ([...] request body) → MEDIUM (rate-limit bypass).

3. High-Risk Ports — Selected (35 total)

4. Missing Security Headers — 6 Findings

5. Always-On HTTP Checks — 15 Paths

Also parse /robots.txt Disallow: paths as next-tier wordlist.

6. JS Guess-Paths for Endpoint Discovery

Probe on every alive webapp (in addition to scraped <script src=...>):

/main.js
/app.js
/bundle.js
/runtime.js
/index.js
/vendor.js
/_next/static/_buildManifest.js
/_next/static/_ssgManifest.js
/static/js/main.js
/static/js/bundle.js
/assets/index.js

For every found JS, also try <jsfile>.map for sourcemap leaks (HIGH INFO_DISCLOSURE).

7. Endpoint Extraction Regex Tiers

Three tiers, run in order on every JS body + every sourcesContent[] blob:

Tier 1 — generic quoted paths:

['"`](/[A-Za-z0-9_\-./{}\[\]?=&%:]+)['"`]

Tier 2 — API-ish paths:

['"`](/(?:api|graphql|gql|v\d+|swagger|openapi|rest|services|internal|admin|auth|oauth|user|users|account|accounts|search|export|upload|file|files|download|webhook|hooks|callback|admin)/[A-Za-z0-9_\-./{}\[\]?=&%:]+)['"`]

Tier 3 — fully-qualified URLs:

\bhttps?://[A-Za-z0-9.\-]+\.[A-Za-z]{2,}(?::\d+)?[/A-Za-z0-9_\-./{}\[\]?=&%:#]*

Dedup on (method, normalized-path-template) where the template replaces /123/ with /{id}/.

8. Internal-Host Leakage Regexes

Run on every JS body + sourcesContent + APK strings + manifest:

RFC1918:

\b(?:10\.(?:\d{1,3}\.){2}\d{1,3}|172\.(?:1[6-9]|2\d|3[01])\.(?:\d{1,3})\.(?:\d{1,3})|192\.168\.(?:\d{1,3})\.(?:\d{1,3})|127\.(?:\d{1,3}\.){2}\d{1,3})\b

Internal DNS suffixes:

\b[A-Za-z0-9][A-Za-z0-9\-]{0,62}\.(?:internal|corp|lan|intranet|local|prod|staging|dev|qa|test)\b

Kubernetes service DNS:

\b[A-Za-z0-9\-]+\.[A-Za-z0-9\-]+\.svc(?:\.cluster\.local)?\b

Each match → MEDIUM INFO_DISCLOSURE. Aggregate per host: if many matches share the same internal subdomain, that's a recon seed for any future internal phase.

9. Email Security Analysis (SPF/DMARC/DKIM/BIMI/MTA-STS)

D="target.example"
dig +short TXT "$D" | grep -i 'v=spf1'
dig +short TXT "_dmarc.${D}"
dig +short MX "${D}"

SPF parsing: -all = strict; ~all = softfail (spoofs land in spam); ?all = permissive. SPF include: reveals SaaS tenants: _spf.google.com → Google Workspace; spf.protection.outlook.com → M365; sendgrid.net → SendGrid; _spf.atlassian.net → Atlassian Cloud.

DMARC severity: p=none → MEDIUM; p=quarantine pct<100 → LOW; p=reject + strict alignment → no finding.

DMARC reporting-vendor inference: When the DMARC record contains rua= or ruf= mailto addresses, the reporting vendor can be inferred from the domain:

dig +short TXT "_dmarc.${D}" | grep -oP 'rua=mailto:\K[^;]+'

This is INFO-level intel, not a finding — it reveals the target's email security vendor stack.

DKIM common selectors:

for selector in default google selector1 selector2 mail email k1 dkim s1 s2 amazonses 20240101 mailchimp sendgrid mxvault; do
  dig +short TXT "${selector}._domainkey.${D}"
done

BIMI check: BIMI presence signals mature email auth (SPF + DMARC + DKIM all enforced).

dig +short TXT "default._bimi.${D}"
# Expect: v=BIMI1; l=<logo-URL>; a=<VMC-URL>

Present → no finding. Absent → INFO only.

MTA-STS check: Controls whether sending MTAs must use TLS for delivery.

dig +short TXT "_mta-sts.${D}"
curl -sS "https://mta-sts.${D}/.well-known/mta-sts.txt"
# Look for mode: enforce | testing | none

mode: enforce → no finding. mode: testing → INFO. Absent with MX records present → LOW.

TLS-RPT check: Complements MTA-STS with TLS failure reporting.

dig +short TXT "_smtp._tls.${D}"
# Expect: v=TLSRPTv1; rua=mailto:<reporting-addr>

Absent → INFO (complementary to MTA-STS).

DNSSEC check: Validates DNS responses are signed.

dig +dnssec "${D}" SOA +short
# Look for RRSIG record in response
dig "${D}" SOA +dnssec | grep -c 'RRSIG'

DNSSEC signed (RRSIG present) → no finding. Not signed → INFO.

PowerShell parallel:

$D = "target.example"
"=== SPF ==="; (Resolve-DnsName $D -Type TXT -EA SilentlyContinue | ? { $_.Strings -match 'v=spf1' }).Strings
"=== DMARC ==="; (Resolve-DnsName "_dmarc.$D" -Type TXT -EA SilentlyContinue).Strings
"=== MX ==="; Resolve-DnsName $D -Type MX -EA SilentlyContinue | Select NameExchange,Preference

MX-to-IdP / mail-host inference: MX records reveal the email hosting provider, which often implies the identity provider.

dig +short MX "${D}" | sort -n

Cross-reference: if MX → M365, load identity-fabric for Entra enum. If MX → Google, check Google Workspace OIDC. Severity: INFO (infrastructure intel, not a finding).

10. Vendor Product Fingerprints

Nuclei fingerprint:

nuclei -u $T -t http/technologies/ -severity info,low,medium,high,critical
nuclei -u $T -t http/cves/ -severity high,critical -etags fuzz

11. Subdomain-Takeover Provider Fingerprints (27 providers)

CNAME targets + "available for claim" response signatures:

For full per-provider detection signatures + edge cases, use SubdomainX or Subzy/Subjack against a freshly-fetched fingerprint database.

12. Cloud Bucket Permutation Arsenal

6 prefixes:

""           # bare candidate
backup-
assets-
static-
dev-
prod-

15 suffixes:

""           # bare candidate
-backup
-assets
-static
-media
-data
-uploads
-dev
-prod
-staging
-logs
-private
-public
-dump
-archive

47 generic stems (filter unless combined with target-identifying token):

www, mail, email, app, apps, web, webmail, ftp, cdn, static, assets, media, img, images,
videos, download, downloads, upload, uploads, data, files, docs, support, help, kb,
blog, news, dev, test, staging, stg, qa, uat, sandbox, preprod, preview, vpn,
mx, smtp, imap, pop, dns, ns, ns1, ns2, mx1, mx2

Provider URL templates:

S3:

https://{candidate}.s3.amazonaws.com/
https://{candidate}.s3-{region}.amazonaws.com/
https://s3.{region}.amazonaws.com/{candidate}/

GCS:

https://{candidate}.storage.googleapis.com/
https://storage.googleapis.com/{candidate}/

Azure Blob:

https://{candidate}.blob.core.windows.net/

Probe technique: HEAD first → 200/301 = exists, 403 = exists private, 404 = skip. On exists, GET root → if XML/JSON listing returns, CRITICAL PUBLIC_CLOUD_BUCKET.

13. Documentation / Wiki Leak Paths

Dorks:

site:notion.site "{target}"
site:trello.com "{target}"
site:miro.com "{target}"
site:atlassian.net "{target}"

14. API Endpoints

Wayback pivot when JS returns empty: If *.js CDX queries return no results (common on brochure-ware or legacy sites), pivot to legacy server-side extensions:

for ext in asp php jsp cfm aspx cgi pl; do
  curl -s "https://web.archive.org/cdx/search/cdx?url=${D}/*.${ext}&output=json&fl=timestamp,original&limit=50" | jq -r '.[][1]' 2>/dev/null
done | sort -u

Legacy endpoints often reveal admin panels, forgotten upload forms, and deprecated APIs that still resolve. Cross-reference discovered paths with §5 always-on HTTP checks. | Postman search | <https://www.postman.com/_api/ws/proxy> | POST (body: {"service":"search","method":"POST","path":"/search-all","body":{"queryIndices":["collaboration.workspace"],"queryText":"{domain}","size":100}}) | | StackExchange | <https://api.stackexchange.com/2.3/search/advanced?site=stackoverflow.com&q={domain}&filter=withbody> | GET |

Structured Outrider run contract

Follow the shared run-contract instructions in ../_shared/run-contract.md.

• Contract skill identifier: web-surface.
• Consume skill_request version 1 and produce skill_result version 1 when participating in an Outrider run.
• Use evidence IDs for all claims; do not cite unregistered local paths as claim evidence.
• Discoveries are observations and do not expand scope or approval.
• Do not claim final finding validation; use finding_candidate only when a human-reviewed candidate should be handed off.
• Do not directly edit manifest.json, scope.yaml, run.jsonl, evidence.jsonl, or approvals.jsonl.
• Use policy-gated MCP with the explicit run_dir; the Python control layer and MCP boundary must reevaluate current controls.