recon

Recon — Attack Surface Mapping

Combine 01-pre-recon.md with light live probing of url (only after the orchestrator's authorization gate passed).

Produce two artifacts:

1. 02-recon.md — narrative of endpoints, parameters, auth/session flows, roles, and which pre-recon leads were confirmed reachable.
2. attack-surface.json:

{
  "endpoints": [
    { "method": "POST", "path": "/login", "params": ["email","password"],
      "auth": "none", "notes": "" }
  ],
  "authFlows": [],
  "roles": []
}

Keep live requests minimal and non-destructive (GET/OPTIONS, no payloads). Write both files into pentest-workspace/<run-id>/.