Recon & Surface Analysis

Use When

• The owner phase is target modeling, endpoint discovery, service enumeration, technology fingerprinting, vhost discovery, subdomain enumeration, or control-plane mapping.
• The next step needs a deduplicated inventory and prioritized validation targets.

Handoff Criteria

• Hand off to pentest-web-enumeration when live HTTP(S) services need application fingerprinting, vhost discovery, route/JS/API enumeration, focused content discovery, or Nuclei-led early checks.
• Hand off to mapper, authz, input/protocol, XSS, business-logic, OOB, CVE, exploit, or reporting workflows when the main blocker becomes focused validation or delivery.

Output Schema

• Surface inventory: asset, interface, auth state, confidence
• Entry-point matrix: input, trust boundary, initial risk hypothesis
• Prioritized next tests: ordered by likely impact and test cost