/web-surface

name: web-surface
description: "Probe paths, endpoint scoring, email security analysis, vendor fingerprints, documentation leak hunting, and API endpoint references for authorized web-surface enumeration."
when_to_use: "Use for Swagger/OpenAPI/GraphQL discovery, endpoint enumeration, email-security analysis (SPF/DMARC/DKIM/BIMI/MTA-STS/TLS-RPT/DNSSEC, MX inference, DMARC vendor), vendor/product fingerprinting (Citrix NetScaler, F5 BIG-IP, Pulse Secure, FortiGate, PaloAlto GlobalProtect, Cisco AnyConnect, VMware vCenter), Wayback CDX mining, Postman workspace hunting, subdomain-takeover checks, or documentation-leak hunting."

Web Surface Enumeration

> Sub-skill of `offensive-osint`. Load `osint-methodology` for pipeline and triage context. > Authorized targets only.

---

BEHAVIORAL CONTRACT

**When triggered:** Web surface enumeration, Swagger/OpenAPI/GraphQL discovery, endpoint probing, email security analysis, vendor fingerprinting, documentation leak hunting, or subdomain takeover assessment is needed.

**Execute:**

1. For each alive webapp, probe the Swagger/OpenAPI paths (§1) and GraphQL paths (§2). 2. Check high-risk ports (§3) against Shodan/naabu results. 3. Audit security headers (§4) — escalate per sensitive-path rules. 4. Run always-on HTTP checks (§5) with listed match logic. 5. Probe JS guess-paths (§6) and extract endpoints via regex tiers (§7). 6. Check for internal-host leakage (§8) in JS bodies, sourcesContent, APK strings. 7. Audit email security posture (§9): parse SPF/DMARC/DKIM/BIMI/MTA-STS/TLS-RPT/DNSSEC, map severity, infer SaaS tenants from TXT records, extract DMARC vendor and MX-based IdP. 8. Fingerprint vendor products (§10) — cross-reference with CISA KEV for severity escalation. 9. Assess subdomain takeover risk (§11) using provider fingerprints. 10. Enumerate cloud buckets (§12) using permutation arsenal. 11. Check documentation/wiki leak paths (§13). 12. Query API endpoints (§14) for Wayback CDX, Postman workspace search, and Stack Exchange OSINT. 13. For each finding, assign severity per the inline tables and emit per `osint-methodology` §3 schema.

**Output:** Per-finding results using `osint-methodology` §3 schema.

**Severity rules:** Swagger/OpenAPI without auth = HIGH. GraphQL introspection without auth = HIGH. Vendor product matching KEV CVE = CRITICAL. Missing HSTS on login page = HIGH (escalated from MEDIUM).

**Gating rules:** Authorized targets only. Detection-aware: if 429s or WAF blocks appear during probing, follow `osint-methodology` §6.4 back-off ladder.

**Chain to:** Load `secrets-and-dorks` for secret scanning of discovered JS/API specs. Load `analysis-and-reporting` for endpoint interest scoring (score >= 70 gets attack-path hint). Feed discovered email security gaps to `people-breach-intel`.

---

1. Swagger / OpenAPI Discovery — 28 Paths

Probe each on every alive webapp. GET (or HEAD if rate-limited).

swagger.json           swagger.yaml
swagger/v1/swagger.json    swagger/v2/swagger.json
swagger-ui.html        swagger-ui/
swagger-resources      api-docs
api-docs.json          api/swagger
api/swagger.json       api/swagger-ui.html
api/v1/swagger.json    api/v2/swagger.json
api/v3/api-docs        v2/api-docs
v3/api-docs            openapi.json
openapi.yaml           openapi/v1
openapi/v3             docs
redoc                  rapidoc
api/docs               api/documentation
api/swagger.yaml       .well-known/openapi

Reachable Swagger/OpenAPI spec without auth → **HIGH** `LEAKY_API_SPEC`.

---

2. GraphQL Discovery — 13 Paths

graphql    graphiql    api/graphql    v1/graphql    v2/graphql
query      api/query   gql            altair
playground subscriptions graphql/console api/v1/graphql

**Standard introspection POST body:**

{
  "operationName": "IntrospectionQuery",
  "query": "query IntrospectionQuery { __schema { types { name kind fields { name type { name kind } } } queryType { name } mutationType { name } subscriptionType { name } } }"
}

• Introspection without auth → **HIGH** `OPEN_GRAPHQL_API`.
• Field-suggestion enumeration (server "did you mean" on typo'd fields) → MEDIUM (re-derive partial schema even when introspection is disabled).
• Batched queries (`[...]` request body) → MEDIUM (rate-limit bypass).

---

3. High-Risk Ports — Selected (35 total)

| Port | Service | Severity | Why it matters | | ----- | ------------------------ | ------------ | -------------------------------------- | | 445 | SMB | **CRITICAL** | EternalBlue, SMB relay | | 2375 | Docker API (unencrypted) | **CRITICAL** | Unauthenticated container takeover | | 3389 | RDP | **CRITICAL** | BlueKeep / DejaBlue | | 6379 | Redis | **CRITICAL** | No auth default; write authorized_keys | | 9200 | Elasticsearch | **CRITICAL** | Typically no auth | | 27017 | MongoDB | **CRITICAL** | No auth by default | | 22 | SSH | LOW | Banner; brute-force surface | | 161 | SNMP | HIGH | Community strings; full device enum | | 389 | LDAP | HIGH | Anonymous bind = full directory dump | | 1433 | MSSQL | HIGH | Brute-force; xp_cmdshell | | 2049 | NFS | HIGH | World-readable exports | | 5432 | PostgreSQL | HIGH | Brute-force; default postgres:postgres | | 5601 | Kibana | HIGH | Often unauthenticated | | 8888 | Jupyter | HIGH | Interactive shell |

---

4. Missing Security Headers — 6 Findings

| Header | Severity (default) | Severity (sensitive path) | | ------------