implementing-attack-surface-management skill (Anthropic-Cybersecurity-Skills)

From Public Agent Wiki

What it does. 'Implements external attack surface management (EASM) using Shodan, Censys, Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Upstream mukul975/Anthropic-Cybersecurity-Skills
Skill file skills/implementing-attack-surface-management/SKILL.md
License Apache-2.0 (skill folder LICENSE)
Author mukul975
Fetched 2026-09-10

Install

  • npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-attack-surface-management, or copy the skill folder into ~/.claude/skills/implementing-attack-surface-management/.
  • Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-attack-surface-management/SKILL.md

SKILL.md (verbatim)

name: implementing-attack-surface-management
description: 'Implements external attack surface management (EASM) using Shodan, Censys,
  and ProjectDiscovery tools (subfinder, httpx, nuclei) for asset discovery, subdomain
  enumeration, service fingerprinting, and exposure scoring. Includes a weighted risk
  scoring algorithm based on OWASP attack surface analysis methodology and the Relative
  Attack Surface Quotient (RSQ). Use when building continuous ASM programs or performing
  external reconnaissance for security assessments.

  '
domain: cybersecurity
subdomain: offensive-security
tags:
- attack-surface
- reconnaissance
- shodan
- censys
- subfinder
- nuclei
- asset-discovery
version: '1.0'
author: mukul975
license: Apache-2.0
nist_csf:
- ID.RA-01
- GV.OV-02
- DE.AE-07
mitre_attack:
- T1078
- T1190
- T1059
- T1595
- T1592

Implementing Attack Surface Management

When to Use

  • When building an external attack surface management (EASM) program from scratch
  • When performing authorized external reconnaissance for penetration testing engagements
  • When continuously monitoring organizational exposure across internet-facing assets
  • When scoring and prioritizing external attack surface risks for remediation
  • When integrating multiple discovery tools into an automated ASM pipeline

Prerequisites

  • Python 3.8+ with requests, shodan, censys libraries installed
  • Shodan API key (free tier provides 100 queries/month)
  • Censys API ID and Secret (free tier available)
  • ProjectDiscovery tools installed: subfinder, httpx, nuclei
  • Go 1.21+ for building ProjectDiscovery tools from source
  • Appropriate authorization for all external scanning activities
  • Target domains and IP ranges with written scope documentation

Instructions

Phase 1: Subdomain Enumeration with Multiple Sources

Use subfinder for passive subdomain discovery leveraging dozens of data sources including certificate transparency logs, DNS datasets, and search engines.

# Install ProjectDiscovery tools
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

# Basic subdomain enumeration
subfinder -d example.com -o subdomains.txt

# Verbose with all sources and recursive enumeration
subfinder -d example.com -all -recursive -o subdomains_full.txt

# Multi-domain enumeration from file
subfinder -dL domains.txt -o all_subdomains.txt

# Using OWASP Amass for deeper enumeration
amass enum -d example.com -passive -o amass_subdomains.txt

# Merge and deduplicate results
cat subdomains.txt amass_subdomains.txt | sort -u > combined_subdomains.txt

Phase 2: Live Host Discovery and Service Fingerprinting

Probe discovered subdomains to identify live hosts, technologies, and services.

# HTTP probing with technology detection
cat combined_subdomains.txt | httpx -sc -cl -ct -title -tech-detect \
    -follow-redirects -json -o httpx_results.json

# Detailed service fingerprinting
cat combined_subdomains.txt | httpx -sc -cl -ct -title -tech-detect \
    -favicon -hash sha256 -jarm -cdn -cname \
    -follow-redirects -json -o httpx_detailed.json

Phase 3: Shodan Asset Discovery

Query Shodan for exposed services, open ports, and known vulnerabilities associated with discovered assets.

import shodan

api = shodan.Shodan("YOUR_SHODAN_API_KEY")

# Search by organization
results = api.search("org:\"Example Corp\"")
for service in results["matches"]:
    print(f"{service['ip_str']}:{service['port']} - {service.get('product', 'unknown')}")
    if service.get("vulns"):
        for cve in service["vulns"]:
            print(f"  CVE: {cve}")

# Search by hostname
results = api.search("hostname:example.com")

# Search by SSL certificate
results = api.search("ssl.cert.subject.cn:example.com")

# Get host details with all services
host = api.host("93.184.216.34")
print(f"IP: {host['ip_str']}")
print(f"Ports: {host['ports']}")
print(f"Vulns: {host.get('vulns', [])}")

Phase 4: Censys Asset Discovery

Use Censys to discover internet-facing assets through certificate and host search.

from censys.search import CensysHosts, CensysCerts

# Host search
hosts = CensysHosts()
query = hosts.search("services.tls.certificates.leaf.subject.common_name: example.com")
for page in query:
    for host in page:
        print(f"IP: {host['ip']}")
        for service in host.get("services", []):
            print(f"  Port: {service['port']} Protocol: {service['transport_protocol']}")
            print(f"  Service: {service.get('service_name', 'unknown')}")

# Certificate transparency search
certs = CensysCerts()
query = certs.search("parsed.names: example.com")
for page in query:
    for cert in page:
        print(f"Fingerprint: {cert['fingerprint_sha256']}")
        print(f"Names: {cert.get('parsed', {}).get('names', [])}")

Phase 5: Vulnerability Scanning with Nuclei

Run targeted vulnerability scans against discovered assets using Nuclei templates.

# Update nuclei templates
nuclei -ut

# Scan with all templates
cat combined_subdomains.txt | httpx -silent | nuclei -o nuclei_results.txt

# Scan with specific severity
cat combined_subdomains.txt | httpx -silent | \
    nuclei -severity critical,high -o critical_findings.txt

# Scan with specific template categories
cat combined_subdomains.txt | httpx -silent | \
    nuclei -tags cve,misconfig,exposure -o categorized_findings.txt

# Scan for exposed panels and sensitive files
cat combined_subdomains.txt | httpx -silent | \
    nuclei -tags panel,exposure,config -o exposed_panels.txt

Phase 6: Exposure Scoring Algorithm

Score each asset based on OWASP attack surface analysis principles, using a weighted formula derived from the Relative Attack Surface Quotient (RSQ) and damage-potential-to-effort ratio.

The scoring algorithm considers:

  1. Open ports and services - weighted by service risk (management ports score higher)
  2. Known vulnerabilities - weighted by CVSS score
  3. Technology age - outdated software increases score
  4. Exposure level - internet-facing vs. authenticated access
  5. Data sensitivity - based on service type and content indicators
# Exposure Score = sum of weighted factors, normalized to 0-100
# See agent.py for the full implementation

Examples

# Run complete ASM pipeline against a target domain
python agent.py \
    --domain example.com \
    --action full_scan \
    --shodan-key YOUR_KEY \
    --censys-id YOUR_ID \
    --censys-secret YOUR_SECRET \
    --output asm_report.json

# Subdomain enumeration only
python agent.py \
    --domain example.com \
    --action enumerate \
    --output subdomains.json

# Exposure scoring on previously discovered assets
python agent.py \
    --domain example.com \
    --action score \
    --input previous_scan.json \
    --output scored_assets.json

# Multi-domain scan from file
python agent.py \
    --domain-list targets.txt \
    --action full_scan \
    --output multi_domain_report.json

Other files in this skill

references/api-reference.md (verbatim)

Attack Surface Management Tooling API Reference

This skill combines several external attack-surface tools. This reference documents the APIs/SDKs/CLIs for each: Shodan, Censys, and the ProjectDiscovery suite (subfinder, httpx, nuclei).

1. Shodan

Authentication

Single API key, passed to the SDK constructor or key query parameter. Get it from the account page (https://account.shodan.io). The key encodes your plan and query credits.

import shodan
api = shodan.Shodan("YOUR_SHODAN_API_KEY")

REST base URL: https://api.shodan.io. Key is sent as ?key=YOUR_KEY.

Key Methods / Endpoints

SDK method REST endpoint Description Parameters
api.host(ip) GET /shodan/host/{ip} All services/banners for one IP ip, history, minify
api.search(query) GET /shodan/host/search Search the banner index query, page, facets, minify
api.count(query) GET /shodan/host/count Result count + facets, no query credits query, facets
api.search_cursor(query) — Generator that auto-paginates all results query, minify
api.scan(ips) POST /shodan/scan Request on-demand scan of IPs/netblocks ips
api.dns.resolve(hosts) GET /dns/resolve Hostname → IP hostnames
api.dns.reverse(ips) GET /dns/reverse IP → hostname ips
api.info() GET /api-info Remaining query/scan credits, plan —
api.exploits.search(q) (Exploits API) Search Exploit DB / CVE / Metasploit query, facets

Search filters used in query: org:, hostname:, net:, port:, ssl.cert.subject.cn:, ssl:, product:, vuln:, country:, http.title:.

Python SDK

# pip install shodan
import shodan
api = shodan.Shodan("YOUR_SHODAN_API_KEY")

# Cheap count first (no query credit consumed)
print(api.count('org:"Example Corp"')["total"])

# Full search with vuln extraction
for svc in api.search('org:"Example Corp"')["matches"]:
    print(svc["ip_str"], svc["port"], svc.get("product"))
    for cve in svc.get("vulns", []):
        print("  ", cve)

# Per-host deep lookup
host = api.host("93.184.216.34")
print(host["ports"], host.get("vulns", []))

Common Response Fields

matches[] items: ip_str, port, transport, product, version, hostnames, org, isp, location (country_code, city), data (raw banner), vulns (list of CVE IDs), ssl, http, timestamp.

Rate Limits

  • 1 request/second is the hard REST API rate limit across the account (the SDK paces search_cursor).
  • Query credits: 1 query credit is deducted per 100 results/pages of search (or per page of domain info). Every credit yields up to 100 results. IP lookups (host()) and count() do NOT consume query credits. Shodan Membership = 100 query credits/month; paid API plans range from 10,000 up to unlimited. Credits reset at the start of each month.
  • Scan credits: separate monthly budget consumed by api.scan() — 1 scan credit per host requested.

Error Codes

401 invalid API key · 403 access denied / plan lacks feature · 429 rate-limit or out of credits · 404 IP not found in index. SDK raises shodan.APIError with the message.

Resources

2. Censys (Platform API)

Authentication

Censys Platform uses a Personal Access Token (PAT) plus an Organization ID (the legacy Search API used an API ID + Secret with HTTP Basic auth). Configure via env vars CENSYS_API_ID / CENSYS_API_SECRET (legacy) or the Platform token. Credentials from https://platform.censys.io.

from censys.search import CensysHosts   # legacy search SDK
hosts = CensysHosts()   # reads CENSYS_API_ID / CENSYS_API_SECRET from env

Key Methods / Endpoints

SDK Description Parameters
CensysHosts().search(query) Search the hosts dataset (returns a paginated query object) query, per_page, pages, fields, sort
CensysHosts().view(ip) Full record for one host ip, at_time
CensysHosts().aggregate(query, field) Faceted aggregation/report query, field, num_buckets
CensysCerts().search(query) Search the certificates dataset query, per_page, pages
CensysCerts().view(fingerprint) Full cert record fingerprint (SHA-256)

Query language (Censys Query Language / CenQL) examples: services.tls.certificates.leaf_data.subject.common_name: example.com, services.port: 443, services.service_name: HTTP, location.country: "United States".

Python SDK

# pip install censys
from censys.search import CensysHosts, CensysCerts

hosts = CensysHosts()
for page in hosts.search(
        "services.tls.certificates.leaf_data.subject.common_name: example.com",
        per_page=100, pages=2):
    for host in page:
        print(host["ip"])
        for s in host.get("services", []):
            print("  ", s["port"], s.get("service_name"))

certs = CensysCerts()
for page in certs.search("parsed.names: example.com"):
    for c in page:
        print(c["fingerprint_sha256"])

Common Response Fields

Host: ip, services[] (port, service_name, transport_protocol, software, tls), location, autonomous_system, dns, operating_system. Cert: fingerprint_sha256, parsed.names, parsed.subject, parsed.issuer, parsed.validity.

Rate Limits

Tiered by plan. Free/community tier is limited (low queries/month and a modest requests-per-second cap); paid Platform tiers raise both. 429 Too Many Requests when exceeded — the SDK backs off and retries.

Error Codes

401 bad credentials · 403 plan restriction · 404 not found · 422 malformed query · 429 rate limit.

Resources

3. ProjectDiscovery Suite (CLI tools)

These are Go CLI tools, not REST APIs. They read stdin / files and write JSON. (ProjectDiscovery Cloud / pdcp offers a hosted API with an PDCP_API_KEY, but the core engines run locally and need no key.)

Installation

go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

subfinder — passive subdomain enumeration

Flag Purpose
-d <domain> Target domain
-dL <file> List of domains
-all Use all sources (some need API keys in ~/.config/subfinder/provider-config.yaml)
-recursive Recursive enumeration
-o <file> / -oJ Output file / JSON lines
-silent Only output subdomains
Provider keys (Shodan, Censys, VirusTotal, SecurityTrails, etc.) go in the provider config to expand passive sources.

httpx — HTTP probing / fingerprinting

Flag Purpose
-sc Status code
-cl Content length
-ct Content type
-title Page title
-tech-detect Wappalyzer tech fingerprint
-favicon / -hash sha256 Favicon hash / body hash
-jarm JARM TLS fingerprint
-cdn / -cname CDN + CNAME detection
-json / -o JSON output / file
-rl <n> Rate limit (requests/sec)

nuclei — template-based vulnerability scanning

Flag Purpose
-u <url> / -l <file> Target(s)
-t <path> Specific template(s)
-tags <tags> Filter by tag (cve,misconfig,exposure,panel)
-severity <levels> critical,high,medium,low,info
-ut / -update-templates Update the template store
-rl <n> / -c <n> Rate limit / concurrency
-o / -json / -jsonl Output

Pipeline example

subfinder -d example.com -all -silent \
  | httpx -silent -tech-detect -json -o live.json
cat live.json | jq -r '.url' \
  | nuclei -severity critical,high -tags cve,exposure -jsonl -o findings.jsonl

Rate Limits

No vendor-imposed API rate limit for local execution — you control load with -rl (requests/sec) and -c (concurrency). Respect target scope/authorization and any provider key limits (Shodan 1 req/s, Censys/SecurityTrails monthly quotas) consumed via subfinder's passive sources.

Resources

Scoring Methodology Note

The skill's exposure score derives from OWASP Attack Surface Analysis and the Relative Attack Surface Quotient (RSQ), weighting open management ports, CVSS-scored known vulns, software age, internet exposure, and data sensitivity. None of these scoring inputs require an external API beyond the discovery data gathered above (Shodan vulns, nuclei CVE matches, httpx tech-detect).

references/asm-reference.md (verbatim)

Reference: Attack Surface Management

Exposure Scoring Algorithm

Weighted Formula

The exposure score uses a weighted composite of five factors, each normalized to 0-100:

Exposure Score = (Port_Score * 0.25) + (Vuln_Score * 0.30) + (Tech_Score * 0.15)
               + (Exposure_Score * 0.15) + (Data_Score * 0.15)

Component Scoring

Open Ports (25% weight)

  • Each port has a risk weight from PORT_RISK_WEIGHTS (1.0-9.5)
  • Management ports (SSH, RDP, Telnet): 8.0-9.5
  • Database ports (MySQL, MongoDB, Redis): 9.0-9.5
  • Web ports (HTTP, HTTPS): 2.5-3.0
  • Formula: min(100, (avg_weight * 10) * log2(count + 1))

Vulnerabilities (30% weight)

  • Weighted by CVSS score bands: Critical=10, High=7, Medium=4, Low=2
  • Diminishing returns via logarithmic scaling
  • Formula: min(100, total_weight * log2(count + 1))

Technology Risk (15% weight)

  • Known high-risk technologies scored 2.0-8.0
  • Struts (8.0), phpMyAdmin (8.0), WebLogic (7.0), Jenkins (7.0)
  • Unknown technologies get baseline score of 10.0

Exposure Level (15% weight)

  • Base score 50 for internet-facing
  • HTTP-only: +15 | CDN protected: -20
  • Auth required (401/403): -25
  • Admin/login panel detected: +20

Data Sensitivity (15% weight)

  • Exposed database ports: +20 each
  • File sharing ports (FTP, SMB): +15 each
  • Sensitive service indicators: +15 each

Risk Levels

Score Range Risk Level
80-100 CRITICAL
60-79 HIGH
40-59 MEDIUM
20-39 LOW
0-19 INFORMATIONAL

OWASP Attack Surface Analysis

Entry Points to Catalog

Per OWASP Attack Surface Analysis Cheat Sheet:

  • Network-accessible ports and services
  • Web application endpoints and parameters
  • Authentication mechanisms
  • File upload functions
  • Administrative interfaces
  • API endpoints
  • Form fields and query parameters

Relative Attack Surface Quotient (RSQ)

Microsoft's RSQ methodology counts:

  1. Channels: TCP/UDP ports, RPC endpoints, named pipes
  2. Methods: HTTP verbs, RPC methods, API functions
  3. Data Items: Files, registry keys, database records

RSQ = sum of (damage_potential / effort) for each attack vector

Shodan Search Operators

Operator Description Example
hostname: Search by hostname hostname:example.com
org: Search by organization org:"Example Corp"
net: Search by CIDR net:93.184.216.0/24
port: Filter by port port:3389
product: Filter by product product:nginx
os: Filter by OS os:"Windows Server 2019"
ssl.cert.subject.cn: SSL cert CN ssl.cert.subject.cn:example.com
vuln: Search by CVE vuln:CVE-2021-44228
country: Filter by country country:US
has_vuln:true Has known vulns hostname:example.com has_vuln:true

Censys Search Syntax

Query Description
services.port: 443 Hosts with port 443 open
services.tls.certificates.leaf.subject.common_name: example.com SSL cert match
services.http.response.html_title: "Admin" Page title match
services.software.product: "Apache" Software product
location.country: "United States" Geographic filter
autonomous_system.asn: 13335 ASN filter

ProjectDiscovery Tool Chain

subfinder

Passive subdomain discovery using 50+ data sources:

  • Certificate transparency (crt.sh, Certspotter)
  • DNS datasets (DNSdumpster, SecurityTrails)
  • Search engines (Google, Bing, Yahoo)
  • Web archives (Wayback Machine, CommonCrawl)
  • Shodan, Censys, VirusTotal APIs
subfinder -d example.com -all -recursive -o subs.txt

httpx

HTTP toolkit for probing and fingerprinting:

  • Status codes, content length, content type
  • Technology detection (Wappalyzer)
  • Favicon hash, JARM fingerprint
  • CDN detection, CNAME resolution
cat subs.txt | httpx -sc -cl -ct -title -tech-detect -json -o httpx.json

nuclei

Template-based vulnerability scanner:

  • 10,000+ community templates
  • Severity-based filtering
  • Protocol support: HTTP, DNS, TCP, SSL, File
  • Automatic template updates
cat live_hosts.txt | nuclei -severity critical,high -tags cve -o findings.txt

Port Risk Classification

Critical Exposure (Score 9.0+)

  • 23 (Telnet): Unencrypted remote access
  • 27017 (MongoDB): Often misconfigured without auth
  • 6379 (Redis): Commonly exposed without auth
  • 445 (SMB): Ransomware propagation vector

High Exposure (Score 7.0-8.9)

  • 22 (SSH): Brute force target
  • 3389 (RDP): BlueKeep, credential attacks
  • 3306/5432/1433 (Databases): Data exfiltration
  • 21 (FTP): Anonymous access, credential theft
  • 161 (SNMP): Community string exposure

Medium Exposure (Score 4.0-6.9)

  • 8080/8443 (Alt HTTP/S): Dev/staging environments
  • 25 (SMTP): Open relay, spoofing
  • 53 (DNS): Zone transfer, cache poisoning
  • 8888 (Various): Development panels

Low Exposure (Score 2.0-3.9)

  • 80 (HTTP): Standard web
  • 443 (HTTPS): Standard secure web

References

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.