# attack-surface-recon

Discovers external company assets, open database ports, leaked repository tokens, and takeover risks. Best for starting security reviews or running perimeter audits.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 351 installs
- Author: securityskills
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/securityskills/skills/tree/HEAD/recon/attack-surface-recon/SKILL.md
- Updated: 2026-08-26
- HTML: https://affpapa.org/en/nevibecode/skills/attack-surface-recon

## What it does

The skill discovers external infrastructure in stages. First, the agent queries certificate transparency records on `crt.sh` and inspects network blocks through `ipinfo` or `bgp.he.net`. Next, it maps subdomains with passive DNS archives and tests permutations like `-dev` or `-staging`. Host liveliness gets validated using `httpx` and `wappalyzer`.

Port verification focuses on exposed services. The inspection flags database ports like 3306 or 5432 alongside unprotected administrative interfaces. The workflow also spots dangling CNAME records susceptible to subdomain takeover and checks GitHub gists for hardcoded corporate credentials. Open cloud storage buckets in S3 or Azure get flagged as well.

Active network scanning requires explicit authorization before execution. When compromised accounts appear during reconnaissance, the skill mandates logging the incident without attempting authentication. The final output groups all discovered hosts into an asset list ranked by risk severity.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill attack-surface-recon -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/attack-surface-recon/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/attack-surface-recon/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill attack-surface-recon -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/attack-surface-recon/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill attack-surface-recon -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/attack-surface-recon/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install securityskills/skills attack-surface-recon
```

2. **Manually: put the files in place**
- File: `.github/skills/attack-surface-recon/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill attack-surface-recon -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/securityskills/skills --path recon/attack-surface-recon
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/attack-surface-recon/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill attack-surface-recon -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/securityskills/skills/tree/HEAD/recon/attack-surface-recon/SKILL.md

## When to use it
- catalog external domains and subdomains from public records
- detect exposed database ports and admin consoles
- identify leaked tokens across public code repositories
- flag dangling DNS records vulnerable to subdomain takeover

## Example prompts
- Map the external attack surface for `example.com` using passive DNS sources.
- Scan public GitHub repositories for leaked credentials belonging to `example-corp`.
- Check our IP ranges for open database ports and dangling CNAME records.

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [securityskills/skills](https://affpapa.org/en/nevibecode/by/securityskills/skills.md) — 9 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md