<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing Attack Surface Management

## ProjectDiscovery Tools

| Tool | Description |
|---|---|
| `subfinder -d <domain>` | Passive subdomain enumeration |
| `httpx -l <hosts>` | HTTP probe and fingerprint |
| `naabu -l <hosts>` | Fast port scanning |
| `nuclei -l <hosts> -tags <tags>` | Template-based scanning |
| `katana -u <url>` | Web crawling and endpoint discovery |

## Shodan CLI

| Command | Description |
|---|---|
| `shodan search "org:<name>"` | Search by organization |
| `shodan host <ip>` | Host information lookup |
| `shodan alert create <name> <cidr>` | Create monitoring alert |
| `shodan alert triggers --enable <trigger>` | Enable alert triggers |
| `shodan stats --facets port "org:<name>"` | Port distribution stats |

## Certificate Transparency

| Endpoint | Description |
|---|---|
| `GET crt.sh/?q=%.<domain>&output=json` | CT log search |

## Shodan Alert Triggers

| Trigger | Description |
|---|---|
| `new_service` | New service detected on monitored IP |
| `open_database` | Exposed database service |
| `vulnerable` | Known vulnerability detected |
| `ssl_expired` | Expired SSL certificate |

## Agent Script

```bash
# Enumerate subdomains
node agent.js subdomains example.com

# Probe live hosts
node agent.js probe subdomains.txt

# Port scan
node agent.js ports subdomains.txt --ports "top-ports 1000"

# Detect shadow IT
node agent.js shadow-it subdomains.txt known_assets.txt

# Exposure scan
node agent.js exposure live_hosts.txt

# Certificate Transparency lookup
node agent.js ct-logs example.com
```
