HackBlue

Tools · Workbench

Attack surface inventory

Lessons on subfinder, Amass, httpx, Nuclei, ffuf, and Gobuster used to inventory and check the domains, hosts, and staging sites your organization owns.

  • 7 lessons
  • 1.5 h of reading
  • 6 topics
Start with lesson 1All workbenches

Outsiders build a list of your hostnames, web services, and forgotten files from public data and a few hours of requests. These lessons build the same list first, compare it with what the organization thinks it owns, and turn every gap into a ticket with an owner.

Passive tools such as subfinder only read third-party datasets. Probes, template scans, and path discovery send traffic, so they run against your own staging hosts, or production with the owner’s written approval and an agreed request rate.

subfinder

1 lesson

  1. 01subfinder: build a subdomain inventory from passive sourcesUse subfinder to list the hostnames public sources already know for a domain you own, keep the source of each name, and diff the list against your DNS records.10 min

Amass

1 lesson

  1. 01Amass: map owned domains, netblocks, and ASNs as one graphRun OWASP Amass in passive mode against your registered domains, then read its asset database to connect names, addresses, and netblocks for an exposure review.12 min

httpx

1 lesson

  1. 01httpx: find which inventoried hosts actually serve web pagesFeed a hostname list to ProjectDiscovery httpx at a polite rate and record status, title, server, and TLS details so the web inventory reflects what is really answering.10 min

Nuclei

2 lessons

  1. 01Nuclei on staging: run curated templates and triage the resultsRun Nuclei against a staging host you own with severity and tag filters and a request rate limit, then sort its findings into real exposures, noise, and items to verify by hand.12 min
  2. 02Writing a Nuclei template that checks your own baselineTurn one internal security requirement, such as HSTS on the login page, into a small Nuclei template, validate it, and run it across every owned web host on a schedule.11 min

ffuf

1 lesson

  1. 01ffuf on your own staging site: find content the route list forgotUse ffuf with a common wordlist, auto-calibration, and a low request rate to find files and folders on a staging host that are missing from the application’s route inventory.11 min

Gobuster

1 lesson

  1. 01Gobuster DNS and vhost modes: audit names after a decommissionUse gobuster dns and vhost modes against your own zone and load balancer to confirm that retired hostnames no longer resolve or route after a migration.10 min