<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: conducting-supply-chain-mapping
description: >-
  Map an organization's digital supply chain including third-party vendors,
  SaaS dependencies, open-source components, and integration points to
  identify supply chain attack vectors.
domain: cybersecurity
subdomain: osint-recon
tags:
  - supply-chain
  - vendor-mapping
  - third-party-risk
  - dependency-analysis
  - saas-discovery
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: >-
  Wappalyzer, BuiltWith, SecurityScorecard, BitSight, Snyk,
  npm audit, pip-audit, retire.js, httpx, nuclei.
metadata:
  mitre-attack:
    - "T1195.001"  # Supply Chain Compromise: Compromise Software Dependencies
    - "T1195.002"  # Supply Chain Compromise: Compromise Software Supply Chain
    - "T1199"      # Trusted Relationship
    - "T1592.002"  # Gather Victim Host Information: Software
---

# Conducting Supply Chain Mapping

## Overview

Supply chain mapping identifies an organization's external dependencies —
third-party vendors, SaaS platforms, open-source libraries, CDN providers,
payment processors, and API integrations. Modern organizations depend on
dozens of external services, each representing a potential attack vector.
Mapping these dependencies reveals trust relationships, shared infrastructure,
and single points of failure that attackers can exploit.

## Prerequisites

- Wappalyzer or BuiltWith for technology identification
- httpx for header and service detection
- retire.js for JavaScript dependency analysis
- pip-audit, npm audit for package vulnerability checking
- DNS tools for third-party service detection
- Python 3.10+ with `requests`, `beautifulsoup4`

```bash
pip install requests beautifulsoup4 pip-audit
npm install -g retire
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
```

## Quick Reference

| Task | Command |
|------|---------|
| Tech stack | `httpx -u target.com -tech-detect -silent -json` |
| JS libraries | `retire --jsrepo --jspath ./js/ --outputformat json` |
| DNS services | `dig +short target.com MX NS TXT CNAME` |
| CSP analysis | `curl -sI https://target.com \| grep -i content-security-policy` |
| BuiltWith | `curl -s "https://api.builtwith.com/free1/api.json?KEY=$BW_KEY&LOOKUP=target.com"` |
| npm audit | `npm audit --json` |
| pip audit | `pip-audit --format json` |
| SRI check | `curl -s https://target.com \| grep -oP 'integrity="[^"]+"'` |

## Workflow

### Step 1: Third-Party Service Discovery

```bash
# DNS records reveal service providers
dig +short target.com MX     # Email provider
dig +short target.com NS     # DNS provider
dig +short target.com TXT    # SPF records show email services

# CSP headers reveal CDN, analytics, and API dependencies
curl -sI https://target.com | grep -i content-security-policy | \
  tr ';' '\n' | grep -oP 'https?://[^\s]+' | sort -u

# Subresource analysis — external JS/CSS includes
curl -s https://target.com | grep -oP 'src="https?://[^"]+' | \
  grep -v "target.com" | cut -d'"' -f2 | sort -u > external_resources.txt
```

### Step 2: Technology and Vendor Identification

```bash
# Wappalyzer API
curl -s -H "x-api-key: $WAPPALYZER_KEY" \
  "https://api.wappalyzer.com/v2/lookup/?urls=https://target.com" \
  | jq '.[].technologies[] | {name, categories: [.categories[].name], website}'

# BuiltWith — historical technology data
curl -s "https://api.builtwith.com/free1/api.json?KEY=$BW_KEY&LOOKUP=target.com" \
  | jq '.Results[].Result.Paths[].Technologies[] | {Name, Tag, FirstDetected, LastDetected}'

# HTTP response headers for vendor identification
curl -sI https://target.com | grep -iE \
  'x-powered-by|server|x-cdn|x-cache|via|x-served-by'
```

### Step 3: Open-Source Dependency Analysis

```bash
# JavaScript dependency scanning
retire --jspath ./extracted_js/ --outputformat json --outputpath retire.json

# Check for known vulnerabilities in package manifests
# npm
npm audit --json > npm_audit.json

# pip
pip-audit --format json --output pip_audit.json

# Extract package.json if accessible
curl -s https://target.com/package.json 2>/dev/null | jq '.dependencies'
```

### Step 4: Integration Point Mapping

```bash
# OAuth/SSO providers
curl -s https://target.com/login | grep -iE \
  '(google|microsoft|okta|auth0|onelogin|azure|saml|oauth)' | head -20

# Payment processors
curl -s https://target.com/checkout 2>/dev/null | grep -iE \
  '(stripe|paypal|braintree|square|adyen)\.com'

# Analytics and tracking
curl -s https://target.com | grep -oP \
  '(google-analytics|googletagmanager|hotjar|mixpanel|segment|amplitude)\.(com|io)' | sort -u

# API endpoints
curl -s https://target.com | grep -oP 'https?://api\.[^"'"'"'\s]+' | sort -u
```

### Step 5: Supply Chain Risk Assessment

```bash
node agent.js --domain target.com --full --output supply_chain.json
```

## Detection Opportunities

- Technology fingerprinting via HTTP headers is passive
- Crawling target site for external resources generates web logs
- DNS queries for service identification are typically unlogged
- npm/pip audit runs against public vulnerability databases

## Verification

- [ ] Third-party services identified via DNS, headers, and page content
- [ ] Technology stack fully mapped with vendor details
- [ ] Open-source dependencies catalogued with vulnerability status
- [ ] Integration points (OAuth, payments, analytics) documented
- [ ] Single points of failure identified in supply chain
- [ ] Vendor risk levels assessed and documented

## References

- [Wappalyzer](https://www.wappalyzer.com/)
- [BuiltWith](https://builtwith.com/)
- [Retire.js](https://retirejs.github.io/retire.js/)
- [pip-audit](https://github.com/pypa/pip-audit)
- [npm audit](https://docs.npmjs.com/cli/v8/commands/npm-audit)
- [SecurityScorecard](https://securityscorecard.com/)

---
v1.0 | Validated: 2026-03-17
