Recon & Surface Analysis
Activation Triggers (Positive)
reconenumeratesurface mapasset inventoryendpoint discoverytechnology fingerprintingcontrol plane mappingffufvhost fuzzingsubdomain enumeration
Exclusion Triggers (Negative)
build exploitweaponize payloadwrite final reportonly validate known vulnerability
Output Schema
- Surface inventory:
asset,interface,auth state,confidence - Entry-point matrix:
input,trust boundary,initial risk hypothesis - Prioritized next tests: ordered by likely impact and test cost
Instructions
- Build an explicit target model first: interfaces, trust boundaries, and identity contexts.
- Enumerate only what is necessary to expose actionable attack paths.
- Normalize findings into a deduplicated inventory before deeper testing.
- Label each surface with attacker preconditions and probable abuse class.
- Mark unknowns that block progression and propose the minimum test to resolve each.
- Hand off precise, testable targets to downstream skills.
Should Do
- Keep reconnaissance hypothesis-driven, not tool-driven.
- Capture reproducible evidence for each discovered surface.
- Prioritize externally reachable and privilege-sensitive paths.
Tip: Fuzzing for Virtual Hosts with FFUF
Discover assets not listed in DNS by testing different Host header values. FFUF is the ideal tool for this speed-efficient enumeration.
Quick Guide
- Optimize: Use small wordlists and fast scans to ensure the agent doesn't get stuck.
- Execute:
ffuf -u $TARGET -H "Host: FUZZ.$TARGET" -w /path/to/small_wordlist - Filter: Identify live hosts by filtering unique response sizes or status codes (e.g.,
-fs [size]or-mc 200).