Attack Surface Mapper
Before testing individual vulnerabilities, map the full attack surface. Untested components are unfound vulnerabilities. This skill produces a structured map that drives testing coverage.
Process
Phase 1 — Enumerate Entry Points
Systematically identify every place an attacker could interact with the target:
- Web — domains, subdomains, ports 80/443, login pages, API endpoints, file upload, search, export
- APIs — REST, GraphQL, SOAP, WebSocket, mobile API backends
- Auth flows — login, registration, password reset, OAuth/SSO, MFA bypass paths
- Network — open ports, admin interfaces (SSH, RDP, Telnet), VPNs, exposed management panels
- Cloud — S3 buckets, blob storage, exposed functions/lambdas, public AMIs, metadata endpoints
- Third-party integrations — webhooks, OAuth providers, embedded iframes, CDN-served content
- Client-side — JavaScript source, local storage, service workers, postMessage handlers
Phase 2 — Identify Trust Boundaries
Mark where the system transitions between trust levels:
- Unauthenticated → authenticated
- User role → admin role
- External network → internal network
- Client-controlled input → server-side processing
Phase 3 — Tech Stack Fingerprint
For each component, note:
- Language / framework
- Version (if visible)
- Authentication mechanism
- Known CVEs for the version (run
check-exploit skill on identified versions)
Phase 4 — Prioritize
Rank attack paths by value. See references/priority-matrix.md.
Output Format
Produce a Surface Map table:
| Component |
Type |
Auth Required |
Tech Stack |
Priority |
Notes |
/api/v2/users |
REST API |
Bearer token |
Node.js/Express |
High |
Returns PII |
admin.target.com |
Web app |
Basic auth |
Apache/PHP |
Critical |
Exposed to internet |
Follow with a Recommended Testing Order — ordered list of highest-value targets first.
Rules
- Do not start testing until Phase 1 is complete — partial maps lead to missed coverage
- If the scope is large, timebox Phase 1 and note what was not mapped
- Reference
check-exploit for every identified technology version
1---2name: attack-surface3description: Maps every entry point, component, and trust boundary of a target before testing begins prevents missed coverage and prioritizes the highest-value attack paths. Trigger when the user provides a target and wants to know where to start, says "map the attack surface", "what should I test", or "where do I begin", or is starting any engagement after scope-grill is complete.4license: MIT5---67# Attack Surface Mapper89Before testing individual vulnerabilities, map the full attack surface. Untested components are unfound vulnerabilities. This skill produces a structured map that drives testing coverage.1011## Process1213### Phase 1 — Enumerate Entry Points1415Systematically identify every place an attacker could interact with the target:1617- **Web** — domains, subdomains, ports 80/443, login pages, API endpoints, file upload, search, export18- **APIs** — REST, GraphQL, SOAP, WebSocket, mobile API backends19- **Auth flows** — login, registration, password reset, OAuth/SSO, MFA bypass paths20- **Network** — open ports, admin interfaces (SSH, RDP, Telnet), VPNs, exposed management panels21- **Cloud** — S3 buckets, blob storage, exposed functions/lambdas, public AMIs, metadata endpoints22- **Third-party integrations** — webhooks, OAuth providers, embedded iframes, CDN-served content23- **Client-side** — JavaScript source, local storage, service workers, postMessage handlers2425### Phase 2 — Identify Trust Boundaries2627Mark where the system transitions between trust levels:28- Unauthenticated → authenticated29- User role → admin role30- External network → internal network31- Client-controlled input → server-side processing3233### Phase 3 — Tech Stack Fingerprint3435For each component, note:36- Language / framework37- Version (if visible)38- Authentication mechanism39- Known CVEs for the version (run `check-exploit` skill on identified versions)4041### Phase 4 — Prioritize4243Rank attack paths by value. See `references/priority-matrix.md`.4445## Output Format4647Produce a **Surface Map** table:4849| Component | Type | Auth Required | Tech Stack | Priority | Notes |50|---|---|---|---|---|---|51| `/api/v2/users` | REST API | Bearer token | Node.js/Express | High | Returns PII |52| `admin.target.com` | Web app | Basic auth | Apache/PHP | Critical | Exposed to internet |5354Follow with a **Recommended Testing Order** — ordered list of highest-value targets first.5556## Rules5758- Do not start testing until Phase 1 is complete — partial maps lead to missed coverage59- If the scope is large, timebox Phase 1 and note what was not mapped60- Reference `check-exploit` for every identified technology version
Rifteo