Skip to content

v0.1.0: Initial release — passive external attack-surface mapping

Choose a tag to compare

View all tags
@cyanheads cyanheads released this 13 Jun 17:56
· 13 commits to main since this release
v0.1.0
This tag was signed with the committer’s verified signature.
cyanheads Casey Hand
SSH Key Fingerprint: lkZCAfVCK5qsrcvEYCs0BnVRDCX7pKsdCZkw5yYKMuw
Verified
Learn about vigilant mode.
573ce9a
This commit was signed with the committer’s verified signature.
cyanheads Casey Hand
SSH Key Fingerprint: lkZCAfVCK5qsrcvEYCs0BnVRDCX7pKsdCZkw5yYKMuw
Verified
Learn about vigilant mode.

Initial release — passive external attack-surface mapping

Passive, non-intrusive EASM for authorized, defensive assessment. Reads
public records and each target's own published surface only — no port
scanning, exploitation, brute-forcing, or vulnerability probing.

Added:

  • attacksurface_map_domain — flagship workflow: CT-log subdomain discovery → DNS liveness → (standard+) DNS records, TLS posture, HTTP headers/tech → optional RDAP/WHOIS → (thorough + Shodan key) per-IP enrichment. depth gating; Promise.allSettled per-source/per-host degradation; observable-facts assessment, never an exploitation path.
  • attacksurface_enumerate_subdomains — passive CT-log discovery (crt.sh → Certspotter → TLS-SAN fallback) with DNS liveness and per-source provenance.
  • attacksurface_resolve_dns — multi-resolver A/AAAA/CNAME/MX/NS/TXT/CAA enumeration with per-resolver propagation reporting and optional reverse PTR.
  • attacksurface_inspect_tls — read-only TLS handshake posture (protocol, cipher, chain, SANs, validity, expiry, issuer, validation, EKU); inspects invalid/expired certs without failing.
  • attacksurface_probe_http — single passive GET with security-header audit (HSTS/CSP/X-Frame-Options/cookies/CORS) and evidence-bound tech fingerprint.
  • attacksurface_lookup_registration — RDAP (302-follow, 5s deadline) with WHOIS port-43 fallback for domains and IP/CIDR netblocks.
  • attacksurface_lookup_host — Shodan single-host lookup and faceted search; typed source_unavailable when SHODAN_API_KEY is unset.
  • attacksurface_recon_guidance — offline synthesis into a prioritized defensive review plan plus pre-filled follow-up calls, including cross-server CVE lookups (nist-nvd, osv-advisory).
  • attacksurface://surface/{domain} — read-once standard-depth surface snapshot.
  • SSRF guard rejecting private/loopback/link-local/cloud-metadata/reserved ranges (IPv4 + IPv6) before every outbound connection; opt out via ATTACKSURFACE_ALLOW_PRIVATE_TARGETS.

STDIO and Streamable HTTP transports. Keyless core; optional Shodan/Certspotter keys.

45 tests pass; bun run devcheck clean.

Assets 3
Loading