External Network Assessment

Tool Chain

Steps

1. OSINT Reconnaissance OSift

   Passive reconnaissance: DNS enumeration, subdomain discovery, email harvesting, breach data checks, WHOIS, certificate transparency.

   Input	Client domain names, known IP ranges
   Output	targets_osint.json, findings_vantage.json
   Usage	osift.py -d <domain> -o <output_dir>
   Notes	Run from outside the client network. No active scanning.

2. Network Reconnaissance Scattershot3

   Active port scanning, service identification, SSL/TLS audit, web technology fingerprinting, banner grabbing, NSE scripts.

   Input	targets_osint.json or manual target list
   Output	findings.json, summary.json, evidence/
   Usage	scattershot3.py -t <targets> -o <output_dir> -c <client> -s ext
   Notes	Feeds OSift targets into SS3 for active scanning. Run within authorized scope.

3. Authentication Detection AuthProbe

   Detect and probe authentication methods on discovered web applications and APIs. Identifies auth type for Fracture/Siphon configuration.

   Input	Web app URLs from SS3 findings
   Output	AuthProbe results (JSON sections)
   Usage	authprobe.py <url> [--rendered] [--json]
   Notes	Run against each discovered web application. Results configure auth for Fracture/Siphon.

4. Web Application Testing Fracture

   OWASP Top 10 2025 testing: nuclei templates, nikto, gobuster, sslscan, custom payloads, authenticated scanning.

   Input	Web app URLs + AuthProbe auth config
   Output	findings.json, evidence/
   Usage	fracture.py -t <target> -o <output_dir> [auth flags]
   Notes	Configure auth method from AuthProbe results. Manage via Crucible for real-time monitoring.

5. API Testing Siphon

   OWASP API Top 10 2023 testing: endpoint discovery, spec-based and specless fuzzing, auth bypass, BOLA/BFLA testing.

   Input	API base URLs + optional OpenAPI spec + AuthProbe auth config
   Output	findings.json, api_inventory.json, api_map.json
   Usage	siphon.py -t <api_url> -o <output_dir> [--spec <openapi.json>] [auth flags]
   Notes	Provide OpenAPI/Swagger spec for spec-based testing. Manage via Crucible.

6. Reporting Prometheus

   Merge findings from all tools, deduplicate, score, rank, map to compliance frameworks, generate Excel/PDF/HTML report.

   Input	Run directories from all preceding tools
   Output	Unified Excel report, HTML report, PDF executive summary
   Usage	prometheus.py -i <run_dirs...> -o <report_dir> -c <client>
   Notes	Prometheus auto-detects tool type from meta.json. Enriches findings via Arbiter catalogue.