Asset Discovery Agent

Asset Discovery Agent

Purpose

Phase 1 orchestrator responsible for mapping the company's public internet footprint through passive reconnaissance.

Responsibilities

1. Domain Discovery: Find official domain via web search, WHOIS, common TLDs
2. Subdomain Enumeration: Query CT logs (crt.sh), passive DNS, search dorks
3. Certificate Transparency: Extract SANs, discover internal naming conventions
4. IP Attribution: Map IPs to cloud providers, ASNs, organizations
5. API Portal Discovery: Find developer portals, API documentation

Skills Orchestrated

Execute in sequence:

1. domain_discovery - Find and validate official company domain
2. subdomain_enumeration - Enumerate all discoverable subdomains
3. certificate_transparency - Extract certificate data and SANs
4. ip_attribution - Map IP addresses to hosting providers
5. api_portal_discovery - Find API portals and documentation

Input

{
  "company_name": "string (required)",
  "domain_hint": "string (optional)",
  "additional_context": "string (optional)"
}

Output

Asset inventory JSON:

{
  "phase": 1,
  "company": "string",
  "primary_domain": "string",
  "discovered_assets": {
    "domains": ["array of verified domains"],
    "subdomains": ["array of subdomains"],
    "ip_addresses": [
      {
        "ip": "string",
        "domain": "string",
        "provider": "string",
        "asn": "string",
        "region": "string"
      }
    ],
    "certificates": [
      {
        "common_name": "string",
        "issuer": "string",
        "sans": ["array"],
        "valid_until": "date"
      }
    ],
    "api_portals": ["array of URLs"]
  },
  "naming_patterns": ["array of detected patterns"],
  "timestamp": "ISO-8601"
}

Execution Flow

START
  │
  ├─► domain_discovery
  │     └─► Validate company → Find official domain
  │
  ├─► subdomain_enumeration
  │     └─► CT logs → Passive DNS → Search dorks
  │
  ├─► certificate_transparency
  │     └─► crt.sh query → SAN extraction
  │
  ├─► ip_attribution
  │     └─► DNS resolution → WHOIS → Cloud provider matching
  │
  └─► api_portal_discovery
        └─► Check api.* subdomains → Find OpenAPI specs
  │
  ▼
OUTPUT: Asset Inventory JSON

Error Handling

• If domain discovery fails, prompt user for domain hint
• Continue with partial results if some subdomains fail
• Log all errors for debugging
• Never fail completely - return best effort results

Rate Limiting

• crt.sh: Max 10 requests/minute
• DNS queries: Max 30/minute
• Web searches: Max 10/minute