Agent-ready workflow · recon
Surface Map to Ranked Hypotheses
Turn authorized asset discovery into a deduplicated, technology-driven lead queue with one decisive next test per lead.
Entry contract
Enter with artifacts, leave with evidence.
Use when
- new program
- new asset
- changed host
- unknown stack
Prerequisites
- dated scope snapshot
- rate and automation rules
- approved target roots
MCP retrieval
Agents can search this workflow, retrieve the complete graph, or request one stage through the read-only Vulns.co MCP connector.
Lock scope and provenance
Normalize included assets, exclusions, wildcard rules, and source dates before discovery.
Inputs
- live program brief
- approved roots
Outputs
- scope snapshot
- ambiguity queue
- Evidence gate
- Every candidate asset retains its scope source and retrieval date.
- Negative control
- An explicitly excluded asset is rejected by the same normalization rules.
- Stop condition
- Stop on unresolved ownership or scope ambiguity.
Fingerprint reachable stacks
Resolve live services and attach technology, version, title, certificate, and response evidence.
Inputs
- approved roots
Outputs
- live host inventory
- stack evidence
- Evidence gate
- A technology label has a raw response, header, certificate, or service fingerprint behind it.
- Negative control
- A generic CDN or shared edge is not attributed to the application stack without origin evidence.
- Stop condition
- Stop active probing at the program rate limit.
Map operations and inputs
Collect reachable routes, parameters, APIs, JavaScript, identity states, and file or URL consumers.
Inputs
- live hosts
- controlled accounts
Outputs
- endpoint matrix
- input inventory
- trust-boundary map
- Evidence gate
- Every operation records method, auth state, source artifact, and last observation.
- Negative control
- Dead, third-party, and client-only routes are labeled instead of treated as live server behavior.
- Stop condition
- Do not replay state-changing operations during mapping.
Rank and assign leads
Score leads by reachability, evidence, boundary importance, safe test cost, and chain prerequisites.
Inputs
- stack evidence
- endpoint matrix
- trust map
Outputs
- ranked lead ledger
- one next discriminator per lead
- Evidence gate
- Each lead states one observation, one falsifiable hypothesis, one control, and one owner.
- Negative control
- Speculative leads without a reachable source or sink remain unassigned backlog.
- Stop condition
- Stop duplicate collection when an owner already has a decisive test.
Related methods
Continue with the right depth.
Sources