Reconnaissance

Auto review

Passive and active information gathering about the target

Hats
2
Review Agents
1
Review
Auto
Unit Types
Passive Recon, Active Recon, Osint
Inputs
None

Hat Sequence

1

Network Mapper

Focus: Map the target's network topology, identify live hosts, open ports, and external-facing services within the authorized scope. Build a comprehensive picture of the attack surface from a network perspective.

Produces: Network map with host inventory, port states, service banners, and preliminary technology fingerprints organized by network segment.

Reads: Intent scope definition, authorized IP ranges and domains, OSINT analyst's findings.

Anti-patterns (RFC 2119):

  • The agent MUST NOT scan hosts or ranges outside the authorized scope
  • The agent MUST NOT use aggressive scan techniques that could cause denial of service
  • The agent MUST NOT fail to document scan parameters and timing for reproducibility
  • The agent MUST NOT skip UDP services or non-standard port ranges without justification
  • The agent MUST correlat network findings with OSINT data
  • The agent MUST NOT run scans without confirming the rules of engagement permit active probing
2

Osint Analyst

Focus: Collect publicly available information about the target using open-source intelligence techniques. DNS records, WHOIS data, certificate transparency logs, publicly indexed pages, leaked credentials databases, social media, job postings, and technology stack fingerprinting.

Produces: OSINT dossier with sourced findings organized by category (infrastructure, personnel, technology, exposure), each with retrieval timestamps and confidence ratings.

Reads: Intent scope definition, rules of engagement, authorized target list.

Anti-patterns (RFC 2119):

  • The agent MUST NOT acces systems or data outside the authorized scope
  • The agent MUST NOT fail to timestamp and source every finding
  • The agent MUST NOT use techniques that could alert the target during passive recon phases
  • The agent MUST NOT skip certificate transparency or DNS enumeration
  • The agent MUST NOT draw conclusions without corroborating across multiple sources
  • The agent MUST NOT store or exfiltrating any actual credentials found in public breaches

Review Agents

Coverage

Mandate: The agent MUST verify reconnaissance covered the full target surface.

Check:

  • The agent MUST verify that all in-scope domains, IPs, and services are enumerated
  • The agent MUST verify that both passive and active reconnaissance techniques were applied
  • The agent MUST verify that discovered assets are categorized by technology stack and exposure level
  • The agent MUST verify that no obvious blind spots (cloud assets, CDN-fronted services, API endpoints)

Reconnaissance

Criteria Guidance

Good criteria examples:

  • "Target profile documents at least 5 external-facing services with technology stack identified for each"
  • "OSINT findings include DNS records, WHOIS data, and publicly indexed endpoints with timestamps"
  • "Network map identifies all in-scope IP ranges, subdomains, and ingress points with confidence ratings"

Bad criteria examples:

  • "Recon is complete"
  • "Target information gathered"
  • "Network has been mapped"

Completion Signal (RFC 2119)

Target profile MUST exist with synthesized findings from both passive and active reconnaissance. All discovered assets are cataloged with technology fingerprints, version information where available, and confidence ratings. Network topology MUST be documented. OSINT findings are timestamped and sourced. The attack surface is mapped at a high level with areas of interest flagged for enumeration.