Attack Surface Mapper

Before testing individual vulnerabilities, map the full attack surface. Untested components are unfound vulnerabilities. This skill produces a structured map that drives testing coverage.

Process

Phase 1 — Enumerate Entry Points

Systematically identify every place an attacker could interact with the target:

• Web — domains, subdomains, ports 80/443, login pages, API endpoints, file upload, search, export
• APIs — REST, GraphQL, SOAP, WebSocket, mobile API backends
• Auth flows — login, registration, password reset, OAuth/SSO, MFA bypass paths
• Network — open ports, admin interfaces (SSH, RDP, Telnet), VPNs, exposed management panels
• Cloud — S3 buckets, blob storage, exposed functions/lambdas, public AMIs, metadata endpoints
• Third-party integrations — webhooks, OAuth providers, embedded iframes, CDN-served content
• Client-side — JavaScript source, local storage, service workers, postMessage handlers

Phase 2 — Identify Trust Boundaries