Attack Surface Recon

Build a complete external attack-surface picture from public sources.

1. Root Domain Discovery

• Start from known brands/domains; expand via certificate transparency (crt.sh), ASN lookups, WHOIS reverse lookups, acquisition history
• Identify cloud ranges: enumerate owned netblocks (bgp.he.net, ipinfo)

2. Subdomain Enumeration

• Passive sources: CT logs, DNS datasets (SecurityTrails-style), web archives
• Active: DNS bruteforce, permutation generation (alterations of known hosts: -dev, -staging, -old)
• Resolve; probe HTTP(S) for live services; fingerprint technologies (httpx/wappalyzer)

3. Exposed Services