Attack Surface Mapping

Attack Surface Mapping

Given one target and one application, draw the surface from what that application already exposes. Then stop. Testing lives in other skills.

This skill is the fast path. Success is a portrait plus a host/API inventory plus a key table plus response-class labels plus an object graph. A probe count is not success.

Field patterns for where the rest of the surface actually lives: SURFACE_PATTERNS.md.

When

• A new URL, a new app, or "I only see a login page"
• Need to know what to test before loading injection / auth / upload skills
• The agent is about to brute directories, spray quotes, or expand to unrelated hosts

Do not use this skill to expand an organization-wide host universe. Map the current application cluster. Finish it. Then, if scope allows, take the next cluster.

Authorization and destruction bounds: hack start gate. Stay in scope.

What must exist (not a file tree)

Before any vulnerability skill, these facts must be retrievable. Persist them in whatever the local workspace already uses for notes and evidence — an existing task folder, a proxy project, session notes, a ticket. Do not invent a new directory layout when one is already in play.

Requests, diffs, and screenshots stay where they were captured when that store is already the working set. Empty inventory plus "I will brute paths next" is a failed mapping.

Fast path

Portrait
  → find the business plane (login is a shell)
  → inventory from the app (JS / traffic / docs), keys not just paths
  → classify responses
  → grow the object graph from responses
  → same-skin / same-gate collapse
  → surface-done → hand off

Do not insert directory brute, full-template scanning, or password spraying into this loop.

1. Portrait (mandatory, before any request spray)

Three to five sentences:

• Who uses this (consumer / merchant / operator)
• Core objects (order, ticket, coupon, document, tenant)
• Which fields hold money, privilege, or state
• What an unauthenticated caller can already touch

Cannot write it → capture one real page's traffic first. Do not scan into a blank portrait.

Mini-program, native app, GraphQL, WebSocket, batch export, agent-with-tools, template preview, file convert, command RPC: treat as this site's surface, not a sidenote.

2. Find the business plane

A login page is a shell. The surface is the post-login business host or the same-host gateway behind the form. Seeing a login page is not a reason to change assets.

Find the plane without logging in:

• Query: service= / redirect_uri= / callback= / returnUrl= / jumpUrl= / next=
• Client: env.js / baseURL / apiHost / /prod-api / VUE_APP_* / REACT_APP_*
• Transport: 302 Location, X-Frame-Options: ALLOW-FROM
• Naming: same-product api / admin / gateway / product host

Someone else's SSO / CAS / OAuth page: do not audit the identity product. Follow it back to this product's business plane. Criterion: the login page's owner is not this business.

Alive vs dead:

Alive ≠ grind the form. Captcha OCR, slider farms, and login-box dictionaries are not mapping.

Form checks that are in-scope for mapping (once, then stop): empty password, skip-password step, extra fields on the login API (tenant / corpId / moduleId), business paths already visible next to the form (list / detail / stats). Username and password boxes are not business parameters.

3. Inventory from the application

Frontend present: open a business page → collect scripts (including async chunks and sourcemaps) → extract APIs and keys → capture traffic to fill gaps → persist endpoints and keys in the local evidence store.

JS extracts more than /api/ paths. For each row, write the value or none:

No frontend / JS blocked: Swagger, OpenAPI, captured traffic, HTML inline, known gateway prefixes. Do not idle waiting for a full JS dump.

Frontend present but inventory empty → directory brute is forbidden.

Docs and debug planes, if this app already linked them: api-recon-and-docs. Exposed VCS / backups: insecure-source-code-management. Both are this cluster's extra planes, not a new search.