Attack Surface

Attack Surface Mapper

Before testing individual vulnerabilities, map the full attack surface. Untested components are unfound vulnerabilities. This skill produces a structured map that drives testing coverage.

Process

Phase 1 — Enumerate Entry Points

Systematically identify every place an attacker could interact with the target:

• Web — domains, subdomains, ports 80/443, login pages, API endpoints, file upload, search, export
• APIs — REST, GraphQL, SOAP, WebSocket, mobile API backends
• Auth flows — login, registration, password reset, OAuth/SSO, MFA bypass paths
• Network — open ports, admin interfaces (SSH, RDP, Telnet), VPNs, exposed management panels
• Cloud — S3 buckets, blob storage, exposed functions/lambdas, public AMIs, metadata endpoints
• Third-party integrations — webhooks, OAuth providers, embedded iframes, CDN-served content
• Client-side — JavaScript source, local storage, service workers, postMessage handlers

Phase 2 — Identify Trust Boundaries

Mark where the system transitions between trust levels:

• Unauthenticated → authenticated
• User role → admin role
• External network → internal network
• Client-controlled input → server-side processing

Phase 3 — Tech Stack Fingerprint

For each component, note:

• Language / framework
• Version (if visible)
• Authentication mechanism
• Known CVEs for the version (run check-exploit skill on identified versions)

Phase 4 — Prioritize

Rank attack paths by value. See references/priority-matrix.md.

Output Format

Produce a Surface Map table:

| Component | Type | Auth Required | Tech Stack | Priority | Notes | |---|---|---|---|---|---| | /api/v2/users | REST API | Bearer token | Node.js/Express | High | Returns PII | | admin.target.com | Web app | Basic auth | Apache/PHP | Critical | Exposed to internet |

Follow with a Recommended Testing Order — ordered list of highest-value targets first.

Rules

• Do not start testing until Phase 1 is complete — partial maps lead to missed coverage
• If the scope is large, timebox Phase 1 and note what was not mapped
• Reference check-exploit for every identified technology version

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: Rifteo
• Source: Rifteo/skills
• License: MIT

Install and usage instructions live in the source repository linked above.