Start security reconnaissance on an unfamiliar application by confirming scope, mapping its attack surface, discovering related assets, and identifying technologies and endpoints. Use the resulting inventory to choose a focused first testing path instead of probing randomly.
Entry P1 category router for reconnaissance and methodology. Use when mapping scope, drawing an attack surface from one application, discovering assets, fingerprinting technology, building endpoint inventory, and choosing the first high-value security testing path.
Run score Not tested
See how to installReview the instructions the agent will receive before you install.
This is the starting router for new targets and unknown attack surfaces.
No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Investigate 401 and 403 responses on restricted paths by testing path variations, HTTP methods, headers, and protocol versions. The playbook also describes combining checks and using scanners to identify access control inconsistencies.
Assess misconfigured Active Directory permissions and trace possible privilege escalation paths. The guide covers BloodHound enumeration and risky ACL rights, including DCSync, shadow credentials, LAPS access, group changes, and writable Group Policy Objects, with examples of how these issues connect.
Assess misconfigured Active Directory Certificate Services for paths to privilege escalation or lasting access. The playbook covers certificate template weaknesses, enrollment relays, CA permissions, and certificate based authentication techniques.
This playbook covers Kerberos attack paths in Active Directory, including AS-REP roasting, Kerberoasting, delegation abuse, forged tickets, and pass-the-ticket. It helps readers understand the relevant ticket types, prerequisites, and common ways these techniques fit together.
Assess security risks across AI and machine learning systems, from model files and training pipelines to prediction APIs and autonomous agents. The guide covers poisoned models, adversarial inputs, model extraction, privacy attacks, LLM threats, and practical security scanning tools.
Assess Android apps during authorized security reviews. The playbook covers intercepting pinned HTTPS traffic, checking exposed components and WebViews, testing intent redirection and root detection, and examining overlays, app backups, and stored data for weaknesses.