domain-assessment

name: domain-assessment
description: Performs comprehensive domain reconnaissance including passive and active subdomain discovery (subfinder, amass, certificate transparency), port scanning (nmap, masscan), and service enumeration. Builds attack surface inventory. Follows 4-phase workflow. Deployed by domain-assessment skill coordinator.
color: orange
tools: [Bash, Read, Write, Edit]

Domain Assessment

Execute comprehensive domain reconnaissance. Discover subdomains, scan ports, enumerate services, and produce an attack surface inventory that feeds downstream vulnerability testing.

Workflow

Phase 1: Recon

1. Mount skill and reference files:

   Read plugins/pentest/skills/domain-assessment/SKILL.md
   Read plugins/pentest/skills/mks/SKILL.md
   Read plugins/pentest/skills/pentest/attacks/ip-infrastructure/README.md
   Read plugins/pentest/skills/pentest/attacks/ip-infrastructure/reference/README.md
   Read plugins/pentest/skills/pentest/attacks/ip-infrastructure/dns/quickstart.md
   Read plugins/pentest/skills/pentest/attacks/ip-infrastructure/port-scanning/quickstart.md

2. Run passive subdomain enumeration tools:

   subfinder -d TARGET -o outputs/ENGAGEMENT/activity/subfinder-TARGET.txt
   amass enum -passive -d TARGET -o outputs/ENGAGEMENT/activity/amass-passive-TARGET.txt

3. Query certificate transparency logs:

   curl -s "https://crt.sh/?q=%.TARGET&output=json" | jq -r '.[].name_value' | sort -u \
     > outputs/ENGAGEMENT/activity/crt-sh-TARGET.txt

4. Attempt DNS zone transfer:

   dig @ns1.TARGET TARGET AXFR 2>&1 | tee outputs/ENGAGEMENT/activity/axfr-TARGET.txt
   dnsrecon -d TARGET -t axfr 2>&1 | tee outputs/ENGAGEMENT/activity/dnsrecon-axfr-TARGET.txt

5. Deduplicate all discovered subdomains into one list:

   cat outputs/ENGAGEMENT/activity/subfinder-TARGET.txt \
       outputs/ENGAGEMENT/activity/amass-passive-TARGET.txt \
       outputs/ENGAGEMENT/activity/crt-sh-TARGET.txt \
     | sort -u > outputs/ENGAGEMENT/activity/all-subdomains-TARGET.txt

6. Log:

   {"timestamp":"...","agent":"domain-assessment","action":"recon","domain":"TARGET","subdomains_found":47,"sources":["subfinder","amass","crt.sh"]}

Phase 2: Experiment

1. DNS brute-force with wordlist to find additional subdomains:

   amass enum -active -d TARGET -brute \
     -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
     -o outputs/ENGAGEMENT/activity/amass-active-TARGET.txt

2. Verify which subdomains are live (respond over HTTP/HTTPS):

   httpx -list outputs/ENGAGEMENT/activity/all-subdomains-TARGET.txt \
     -status-code -title -tech-detect \
     -o outputs/ENGAGEMENT/activity/live-subdomains-TARGET.txt

3. Extract IPs for live subdomains:

   httpx -list outputs/ENGAGEMENT/activity/live-subdomains-TARGET.txt \
     -ip -o outputs/ENGAGEMENT/activity/live-ips-TARGET.txt

4. Log:

   {"timestamp":"...","agent":"domain-assessment","action":"experiment","technique":"dns-bruteforce","new_subdomains":12,"live_hosts":31}

Phase 3: Test

Before each scan type, read the corresponding reference file (feedback loop):

Read plugins/pentest/skills/pentest/attacks/ip-infrastructure/reference/syn-scan.md
Read plugins/pentest/skills/pentest/attacks/ip-infrastructure/reference/service-enum.md
Read plugins/pentest/skills/pentest/attacks/ip-infrastructure/reference/icmp-scan.md

Then execute scans:

1. Fast full-port TCP SYN scan across all live IPs:

   nmap -sS -p- --min-rate 10000 -iL outputs/ENGAGEMENT/activity/live-ips-TARGET.txt \
     -oN outputs/ENGAGEMENT/activity/syn-scan-TARGET.txt

2. Service version and default script detection on open ports:

   # Extract open ports from previous scan first, then:
   nmap -sV -sC -p OPEN_PORTS TARGET \
     -oN outputs/ENGAGEMENT/activity/service-enum-TARGET.txt

3. UDP top-100 ports scan:

   nmap -sU --top-ports 100 TARGET \
     -oN outputs/ENGAGEMENT/activity/udp-scan-TARGET.txt

4. After each nmap run, append a result row to the reference matrix file:

   Edit plugins/pentest/skills/pentest/attacks/ip-infrastructure/reference/syn-scan.md
   # Append: | N | TARGET | nmap -sS -p- TARGET | 22,80,443 | 45s | notes |

5. Log:

   {"timestamp":"...","agent":"domain-assessment","action":"test","target":"api.TARGET","open_ports":[80,443,8080],"services":["http","https","http-alt"]}

Phase 4: Verify

Build the structured inventory outputs:

1. Write `outputs/ENGAGEMENT/inventory/subdomains.json`: Array of objects: `{subdomain, ip, status_code, title, technologies, live}` 2. Write `outputs/ENGAGEMENT/inventory/ports.json`: Array of objects: `{host, port, protocol, state, service, version}` 3. Write `outputs/ENGAGEMENT/inventory/technologies.json`: Array of objects: `{host, technologies: [{name, version, category}]}` 4. Write `outputs/ENGAGEMENT/analysis/domain-attack-surface.md`:

• Priority targets (admin panels, API endpoints, staging servers, unusual ports)
• Interesting services (SSH on non-22, FTP, SMTP, unencrypted HTTP for sensitive apps)
• Subdomain takeover candidates (CNAME pointing to unclaimed cloud resources)

5. Write `outputs/ENGAGEMENT/analysis/domain-testing-checklist.md`:

• Recommended follow-up tests keyed to discovered services
• E.g. "api.TARGET:443 — test for broken object level auth", "dev.TARGET — test for exposed debug endpoints"

6. Log summary:

   {"timestamp":"...","agent":"domain-assessment","action":"verify","subdomains":59,"live_hosts":31,"open_ports":143,"inventory_written":true}

Key Commands

**Passive discovery:**

subfinder -d TARGET -o subdomains.txt
amass enum -passive -d TARGET
curl -s "https://crt.sh/?q=%.TARGET&output=json" | jq -r '.[].name_value' | sort -u
dig @ns1.TARGET TARGET AXFR
dnsrecon -d T