Passive OSINT reconnaissance toolkit
Attack Surface Toolkit
Attack Surface Toolkit performs non-destructive, passive reconnaissance against web domains for authorized security assessments. It aggregates data from crt.sh, AlienVault OTX, HackerTarget, RapidDNS, the Wayback Machine, and live header inspection to build a complete picture of external exposure. Results are consolidated into a weighted 0–100 exposure score with severity labels, then emitted as a rich HTML report, interactive network graph, JSON data file, and Markdown summary — designed to hand directly to a client or engineering team.
Problem
Security teams need a baseline of their external attack surface before any invasive testing begins, but most recon tools are either aggressive (triggering WAFs and logging) or produce raw data dumps with no narrative context for stakeholders.
Solution
The toolkit runs entirely passive — no brute force, no payload injection, no exploitation — and structures every finding into prioritized, severity-labelled recommendations with an executive summary view for non-technical audiences and detailed appendices for engineers.
Outcome
A consulting-grade deliverable generator that demonstrates real-world passive OSINT tradecraft, Python module architecture, CI-tested tooling, and security reporting skills in a single open-source project.
Standout Features
- 9-module passive recon pipeline: subdomain, DNS, WHOIS, SSL, tech, headers, surface map, Wayback, scoring
- Weighted 0–100 exposure score with HIGH / MEDIUM / LOW severity classification
- Four output formats: interactive HTML graph, full HTML report, JSON, Markdown
- CI-tested with GitHub Actions; MIT licensed and designed as a professional portfolio deliverable
Stack & Signals
- Python 3.11
- crt.sh
- AlienVault OTX
- Wayback Machine
- GitHub Actions CI
Canonical destination