1---2name: pentest-recon-attack-surface3description: White-box attack surface mapping — correlate external scans, browser exploration, and source code into structured endpoint inventory, role architecture, and authorization vulnerability candidates.4---56# Pentest Recon Attack Surface78## Purpose9Perform comprehensive attack surface mapping by correlating three data sources: external network scans, authenticated browser exploration, and source code analysis. Produces a structured endpoint inventory with authorization metadata, role/privilege architecture, and prioritized authorization vulnerability candidates for downstream code review and exploitation.1011## Prerequisites1213### Authorization Requirements14- **Written authorization** with explicit scope for reconnaissance and source code access15- **Source code access** to the target application (white-box engagement)16- **Test accounts** at every privilege level (anonymous, user, admin, service)17- **Network scan approval** — confirm acceptable scan intensity with target owner1819### Environment Setup20- nmap, subfinder, httpx, whatweb for external reconnaissance21- Playwright with authenticated browser contexts22- katana or gospider for web crawling23- ffuf for content discovery24- semgrep and ripgrep for source code analysis25- Access to deployment configs (Dockerfile, docker-compose, k8s manifests)2627## Core Workflow281. **Technology Fingerprinting**: Run whatweb + httpx to identify frameworks, languages, server versions, WAF presence, and response header signatures.292. **External Scan Correlation**: Execute nmap service scan + subfinder subdomain enumeration. Cross-reference discovered services against deployment configs (docker-compose ports, k8s service definitions) to identify exposed vs internal-only services.303. **Interactive Browser Exploration**: Authenticated Playwright crawl at each privilege level. Capture all XHR/fetch requests, form submissions, WebSocket connections, and dynamic route transitions. Record request/response pairs with auth context.314. **Route Mapper**: Parse all backend route definitions from source code with file:line pointers. Extract HTTP method, path pattern, middleware chain, and handler function for every endpoint.325. **Authorization Checker**: For each route, trace the middleware chain to identify auth/authz enforcement. Flag endpoints missing authentication middleware or with inconsistent authorization patterns.336. **Input Validator**: Analyze validation logic per parameter — identify parameters with no server-side validation, client-only validation, or incomplete validation (e.g., type check but no range check).347. **Session Handler**: Trace token lifecycle from issuance through validation to expiry. Map session storage mechanism, token rotation policy, and logout invalidation behavior.358. **Authorization Architecture**: Synthesize role definitions, permission assignments, and privilege lattice from source code. Identify horizontal/vertical/workflow authorization vulnerability candidates.3637## Output Deliverables3839| Deliverable | Description |40|-------------|-------------|41| API Endpoint Inventory | Table: method, path, auth_required, roles_allowed, validation_summary, file:line |42| Network Interaction Map | External services, internal services, exposed ports, subdomain inventory |43| Role & Privilege Architecture | Role hierarchy, permission matrix, privilege escalation paths |44| Authorization Vulnerability Candidates | Prioritized list of endpoints with suspected authz gaps |45| Session Architecture | Token type, storage, rotation, expiry, invalidation behavior |4647## Tool Categories4849| Category | Tools | Purpose |50|----------|-------|---------|51| Fingerprinting | whatweb, httpx, wappalyzer | Technology and framework identification |52| Network Recon | nmap, subfinder, amass | Service discovery and subdomain enumeration |53| Web Crawling | Playwright, katana, gospider | Authenticated crawling and dynamic exploration |54| Content Discovery | ffuf, feroxbuster | Hidden endpoint and directory discovery |55| Code Analysis | semgrep, ripgrep, ast-grep | Route extraction and middleware tracing |56| Config Analysis | manual review | Deployment config correlation |5758## References59- `references/tools.md` - Tool function signatures and parameters60- `references/workflows.md` - Reconnaissance workflow definitions and correlation procedures
jd-opensource