Mapping Attack Surface

Mapping attack surface (black-box)

You can't test what you haven't found, and you'll waste the engagement testing low-value surface first. Recon is the discipline of turning "here's a URL" into a prioritized inventory of everything that takes input, ordered by where bugs live. This skill is the front of the black-box workflow; per-class hunting skills act on its output.

Scope gate - before anything else

Establish and write down scope first, and check every action against it:

• Record the authorization: which hosts/domains/apps are in scope, which are explicitly out, the rules (rate limits, no-DoS, no social engineering, test- account only), and the reporting channel. Keep it where you'll re-read it.
• Check every request against scope before sending it. A wildcard in a program's scope is not permission to hit a third party's system that happens to be reachable.
• Passive before active; low-impact before high. Prefer observation over probing until you've confirmed a target is in scope and the action is allowed.
• Never run destructive or state-changing actions (delete, mass-write, account takeover attempts) without explicit authorization for them.

If you can't point to the authorization for a host or an action, it's out of scope. Stop and confirm.

The recon loop

1. Enumerate hosts. From the in-scope roots: subdomains, related domains, and the apps behind them. Distinguish the origin from CDN/WAF front - testing a CDN edge as if it were the origin yields noise.

2. Fingerprint the stack. Server, framework, language, CMS, reverse proxy, auth provider, cloud. The stack tells you which bug classes are plausible and which default misconfigurations to check.

3. Enumerate endpoints and parameters. Walk the app as an authenticated user (with an in-scope test account), capture the real traffic, and pull the API surface from it. Add documented surface (OpenAPI/GraphQL introspection, JS bundles that reveal routes and params). Most surface is not what you clicked

   • it's referenced in client code and specs.

4. Map the auth and session model. How you log in, what a token/cookie represents, what scopes/roles exist, where the boundary between users sits. This is where the highest-severity black-box bugs (IDOR/BOLA, BFLA, auth bypass) live - map it deliberately, not incidentally.

5. Catalog state-changing and input-taking operations. Every endpoint that writes, uploads, redirects, fetches a URL, renders a template, or takes an id. These are your candidate anchors for the vuln-class skills.

6. Prioritize. Order the surface by expected yield: authenticated state-changers and object references (IDOR/BFLA) and anything that reflects, fetches, or parses input first; static/low-privilege surface last. Rank is triage - the whole inventory stays on the list; the order just says what to test first.

What "good recon output" looks like

A written inventory, not a memory: hosts (origin vs edge), stack, an endpoint table (method, path, params, auth required, what it does), the auth/role map, and a prioritized test order. Everything downstream reads from this.

Worked example

Target: a SaaS app, one in-scope root.

1. Subdomain enum → app., api., admin. (confirm each in scope).
2. Fingerprint → framework X behind a CDN; note the CDN vs origin.
3. Authenticated crawl + captured traffic → 140 endpoints; JS bundle reveals 20 more never navigated to, including /api/v1/org/{id}/members.
4. Auth map → two roles (member, admin); token is a JWT with an org claim.
5. State-changers → invite, role-change, export, avatar-upload, redirect-after- login.
6. Prioritize → {id}/{org} object refs and the role-change endpoint first (IDOR/BFLA), then the URL-fetch and upload endpoints, then reflected params. Output: a surface table handed to the IDOR, auth, SSRF, and upload skills.

Rationalizations to reject

• "It's reachable, so it's in scope." → Reachability is not authorization. Check the written scope for every host and action.
• "I'll just start testing the first endpoint I see." → Untriaged testing burns the engagement on low-value surface. Inventory and prioritize first.
• "What I clicked is the surface." → Most surface hides in client code, specs, and un-linked routes. Pull it from captured traffic and bundles.
• "I'll remember the endpoints." → Write the inventory. Recon you didn't record is recon you'll redo.

Executing this in practice

Use whatever capture and enumeration tooling you have: an intercepting proxy or browser capture for authenticated traffic, subdomain/asset enumeration for hosts, and spec/bundle extraction for hidden routes. The output is tool-agnostic - a written, prioritized surface inventory. Confirmed issues found while testing it are written up with writing-vuln-reports.

Related

• writing-vuln-reports - for anything confirmed during testing.
• (roadmap) per-class black-box skills - IDOR/BOLA, auth-bypass/BFLA, SSRF, open redirect, upload, injection - each consuming this inventory.