<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Attack Surface Discovery — API Reference

## Subdomain Enumeration

```bash
# subfinder — passive subdomain discovery
subfinder -d target.com -all -silent -o subdomains.txt

# amass — comprehensive enumeration
amass enum -passive -d target.com -o amass_subdomains.txt

# crt.sh — certificate transparency
curl -s "https://crt.sh/?q=%.target.com&output=json" | jq -r '.[].name_value' | sort -u
```

## HTTP Probing

```bash
# httpx — probe live hosts with tech detection
cat subdomains.txt | httpx -silent -status-code -title -tech-detect -json -o live.json

# httpx — screenshot and response hash
cat subdomains.txt | httpx -silent -screenshot -store-response -o screenshots/
```

## Port Scanning

```bash
# nmap — service version detection
nmap -sV -sC --top-ports 1000 -iL targets.txt -oA nmap_results

# masscan — fast port discovery
masscan -iL targets.txt -p0-65535 --rate 10000 -oJ masscan_results.json
```

## Shodan API

```bash
# Search by organization
curl -s "https://api.shodan.io/shodan/host/search?key=$SHODAN_KEY&query=org:\"Target\"" | jq '.matches[]'

# Host details
curl -s "https://api.shodan.io/shodan/host/1.2.3.4?key=$SHODAN_KEY"

# DNS lookup
curl -s "https://api.shodan.io/dns/resolve?hostnames=target.com&key=$SHODAN_KEY"
```

## Nuclei Templates

```bash
# Scan for exposures
nuclei -l hosts.txt -t exposures/ -severity critical,high

# Scan for misconfigurations
nuclei -l hosts.txt -t misconfigurations/ -o misconfig_findings.txt

# Scan for CVEs
nuclei -l hosts.txt -t cves/ -severity critical,high -o cve_findings.txt

# Custom template scan
nuclei -l hosts.txt -t custom-templates/ -json -o custom_findings.json
```

## Key Tools Reference

| Tool | Purpose | Output |
|------|---------|--------|
| `subfinder` | Passive subdomain enumeration | Domain list |
| `httpx` | HTTP probing + tech detection | JSON with status, title, tech |
| `nuclei` | Template-based scanning | Findings with severity |
| `nmap` | Port/service scanning | XML/JSON scan results |
| `Shodan` | Internet-wide asset search | Host details + vulns |
| `crt.sh` | Certificate transparency | Certificate records |
