# Attack Surface Recon

> Map an organization's external attack surface — domains, subdomains, exposed services, leaked credentials, and brand abuse. Use at the start of assessments or for continuous monitoring.

- Skill: `securityskills/attack-surface-recon` (Agent Skill)
- Install (CLI): `npx skillmds@latest add securityskills/attack-surface-recon`
- Raw SKILL.md: https://api.skillmd.com/api/skills/securityskills/attack-surface-recon/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: securityskills (https://skillmd.com/u/securityskills)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/securityskills/attack-surface-recon

---


# Attack Surface Recon

Build a complete external attack-surface picture from public sources.

## 1. Root Domain Discovery

- Start from known brands/domains; expand via certificate transparency (crt.sh), ASN lookups, WHOIS reverse lookups, acquisition history
- Identify cloud ranges: enumerate owned netblocks (bgp.he.net, ipinfo)

## 2. Subdomain Enumeration

- Passive sources: CT logs, DNS datasets (SecurityTrails-style), web archives
- Active: DNS bruteforce, permutation generation (alterations of known hosts: `-dev`, `-staging`, `-old`)
- Resolve; probe HTTP(S) for live services; fingerprint technologies (httpx/wappalyzer)

## 3. Exposed Services

- Port scan in-scope IPs (top ports minimum, full range on high-value hosts)
- Flag: exposed admin panels, databases (3306/5432/27017), RDP/SMB, Redis/Memcached, Kubernetes API, VPN portals, file shares
- Takeover checks: dangling CNAMEs pointing at deprecated cloud services

## 4. Credential and Code Leaks

- Breach data for corporate domains (report presence; never view more than proof)
- Public code search (GitHub/gists) for org domains, tokens, internal hostnames in commits
- Exposed storage: open S3 buckets/azure blobs matching org naming patterns

## 5. People and Brand

- Employee enumeration via LinkedIn for phishing-simulation scoping (policy permitting)
- Lookalike domains registered recently (typosquats), abuse of brand in app stores

## Rules

- Passive sources preferred; active scanning only within authorization
- Found leaked credentials: report immediately, do not log in with them

## Output

Ranked asset inventory: exposed services by risk, credential leak notifications, takeover-prone records, and monitoring recommendations.