<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Attack Surface Analysis — API Reference

## agent.js CLI

```bash
# Discover external assets
node scripts/agent.js --action discover --domain example.com

# Enumerate entry points
node scripts/agent.js --action enumerate --domain example.com

# Score attack surface
node scripts/agent.js --action score --inventory inventory.json

# Generate reduction plan
node scripts/agent.js --action reduce --inventory inventory.json --output plan.json
```

## External Reconnaissance Tools

```bash
# Subdomain enumeration
subfinder -d example.com -all -o subdomains.txt

# Port scanning
nmap -sV -sC -p- --min-rate 1000 -oA results -iL targets.txt

# Certificate transparency
curl -s "https://crt.sh/?q=%25.example.com&output=json" | jq -r '.[].name_value' | sort -u

# DNS enumeration
dig +short example.com ANY
host -t MX example.com
```

## Cloud Asset Discovery

```bash
# AWS — public-facing resources
aws ec2 describe-instances --filters "Name=ip-address,Values=*" \
  --query 'Reservations[].Instances[].{ID:InstanceId,IP:PublicIpAddress}'
aws elbv2 describe-load-balancers --query 'LoadBalancers[].DNSName'
aws s3api list-buckets

# Azure — public resources
az vm list -d --query '[].{name:name,publicIps:publicIps}'
az network public-ip list

# GCP — external IPs
gcloud compute addresses list --filter="status=IN_USE"
gcloud compute forwarding-rules list
```

## Attack Surface Scoring

| Factor | Weight | Values |
|--------|--------|--------|
| Exposure | 1-3 | 1=internal, 2=DMZ, 3=internet |
| Protocol complexity | 1-3 | 1=HTTPS, 2=SSH, 3=RDP/FTP |
| Privilege potential | 1-5 | 1=none, 3=user, 5=admin |
| Score = exposure × protocol × privilege | | Max: 45 per entry point |
