mapping-attack-surfacelisted

# Mapping attack surface (black-box) You can't test what you haven't found, and you'll waste the engagement testing low-value surface first. Recon is the discipline of turning "here's a URL" into a prioritized inventory of everything that takes input, ordered by where bugs live. This skill is the front of the black-box workflow; per-class hunting skills act on its output. ## Scope gate - before anything else Establish and write down scope *first*, and check every action against it: - **Record the authorization**: which hosts/domains/apps are in scope, which are explicitly out, the rules (rate limits, no-DoS, no social engineering, test- account only), and the reporting channel. Keep it where you'll re-read it. - **Check every request against scope before sending it.** A wildcard in a program's scope is not permission to hit a third party's system that happens to be reachable. - **Passive before active; low-impact before high.** Prefer observation over probing until you've confirmed a target is in scope and the action is allowed. - **Never run destructive or state-changing actions** (delete, mass-write, account takeover attempts) without explicit authorization for them. If you can't point to the authorization for a host or an action, it's out of scope. Stop and confirm. ## The recon loop 1. **Enumerate hosts.** From the in-scope roots: subdomains, related domains, and the apps behind them. Distinguish the origin from CDN/WAF front - testing a CDN edge