# Attack Surface Mapping

Draw a testable attack surface from one authorized target URL or one application.

- Repository: https://github.com/yaklang/hack-skills (2601 stars)
- Category: Business
- License: MIT
- Last updated: 2026-09-13
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add yaklang/hack-skills --skill attack-surface-mapping -g -a claude-code -y`
Codex: `npx skills add yaklang/hack-skills --skill attack-surface-mapping -g -a codex -y`
Cursor: `npx skills add yaklang/hack-skills --skill attack-surface-mapping -g -a cursor -y`
Gemini CLI: `npx skills add yaklang/hack-skills --skill attack-surface-mapping -g -a gemini-cli -y`

## Description

Draw a testable attack surface from one authorized target URL or one application. Use when the user says 攻击面, 供给面, 画攻击面, map the surface, application recon, find the business host, JS inventory, or when the only visible page is login. Derive hosts, APIs, keys, and the object graph from what the app already exposes. Do not open with directory brute or payload spray. Use when the user runs /attack-surface-mapping.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Attack Surface Mapping

Given **one target** and **one application**, draw the surface from what that application already exposes. Then stop. Testing lives in other skills.

This skill is the fast path. Success is a portrait plus a host/API inventory plus a key table plus response-class labels plus an object graph. A probe count is not success.

Field patterns for where the rest of the surface actually lives: [SURFACE_PATTERNS.md](./SURFACE_PATTERNS.md).

## When

- A new URL, a new app, or "I only see a login page"
- Need to know **what** to test before loading injection / auth / upload skills
- The agent is about to brute directories, spray quotes, or expand to unrelated hosts

Do **not** use this skill to expand an organization-wide host universe. Map the current application cluster. Finish it. Then, if scope allows, take the next cluster.

Authorization and destruction bounds: [hack](../hack/SKILL.md) start gate. Stay in scope.

## What must exist (not a file tree)

Before any vulnerability skill, these facts must be retrievable. Persist them in whatever the local workspace already uses for notes and evidence, an existing task folder, a proxy project, session notes, a ticket. Do not invent a new directory layout when one is already in play.

| Fact | Keep |
|---|---|
| Portrait | 3, 5 sentences, not an essay |
| Hosts | Business hosts, gateways, API domains this app already named |
| Endpoints | Method, path, params, auth required? |
| Keys | Signing salt, ciphertext id + frontend pubkey, hidden/admin route, hardcoded demo account. Record `none` per row if absent |
| Response class | Login-gate / differential / unauthenticated exception |
| Object graph | list → detail → attachment / export / approval |

Requests, diffs, and screenshots stay where they were captured when that store is already the working set. Empty inventory plus "I will brute paths next" is a failed mapping.

## Fast path

The rest: https://github.com/yaklang/hack-skills/blob/HEAD/skills/attack-surface-mapping/SKILL.md