Reconnaissance

Domain and web application reconnaissance. Discovers subdomains, open ports, endpoints, APIs, and JavaScript routes to build attack surface inventory.

Phases

Domain Assessment

1. Subdomain Discovery - Passive DNS, certificate transparency, DNS brute-forcing, zone transfers
2. Port Scanning - nmap/masscan (top 1000/10000/all), service detection, OS fingerprinting
3. Service Enumeration - Version detection, banner grabbing, protocol-specific enumeration

Web Application Mapping

0. Software Inventory - Dependencies, frameworks, SBOM generation
1. Active Scanning - ffuf, gobuster, nikto, ZAP spider for directories/files
2. API Discovery - REST, GraphQL, SOAP, WebSocket, Swagger/OpenAPI docs
3. JavaScript & SPA - Client-side routes, dynamic scripts, browser storage
4. Surface Analysis - Categorize attack surfaces, prioritize by risk

Output