Back to Details

recon-scope-triage

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

When to use this skill

何时使用此 skill

Trigger when:
  • The target brand is a common/dictionary word or shared term (e.g. 
    apex
    , 
    summit
    , 
    vertex
    , 
    nova
    , 
    core
    , 
    orbit
    , 
    pulse
    , 
    unity
    …)
  • You receive an ASM report, recon export, breach combo, repo list, bucket list, or mobile-app list to act on
  • A "Critical" count looks implausibly high (hundreds) for the org's size
  • Any asset's ownership is asserted by the tool but not proven
The two failure modes this skill prevents:
  1. Wasting the engagement testing/triaging assets that aren't the target's.
  2. Attacking an innocent third party that merely shares the name — out of scope, and real harm.
Rule: ownership is guilty-until-proven. An asset is the target's only when a concrete ownership signal ties it to the target — never because a scanner's keyword matched.
触发条件：
  • 目标品牌是常见词或词典词，或属于共享术语（例如 
    apex
    、
    summit
    、
    vertex
    、
    nova
    、
    core
    、
    orbit
    、
    pulse
    、
    unity
    ……）
  • 收到需要处理的 ASM 报告、recon 导出数据、泄露 combo、repo 列表、bucket 列表或 mobile-app 列表
  • 对于该组织的规模而言，"Critical" 数量看起来高得不合常理（达到数百个）
  • 工具声称某项资产归目标所有，但尚未证明其归属
此 skill 可防止两种失败模式：
  1. 浪费项目时间，测试或分流并不属于目标的资产。
  2. 攻击无辜的第三方。这些组织只是与目标同名——它们不在范围内，而且会造成真实伤害。
规则：在证明归属之前，不能仅凭扫描器的关键词匹配就认定资产属于目标。只有当具体的归属信号将资产与目标关联时，才能认定其属于目标。

The collision sources (where keyword-matching lies)

冲突来源（关键词匹配容易产生误判的地方）

Recon sourceHow it collidesVerify ownership by
GitHub reposSearch matched the brand word in repo name / topic / a stringRepo owner is the org's GH org; commits from org emails; code references the org's real domains/infra. A repo named 
<word>-backend
by a random user = noise.
Cloud buckets (S3/GCS)Bucket names are a global namespace; 
<word>-static
, 
<word>-data
, 
<word>-public
exist for someone		Bucket content references the target; bucket name correlates with a confirmed target subdomain (
x.target.com
↔ 
x-public
) AND content matches; ACL/owner metadata. Generic content (other-language, other-industry) = not theirs.
Mobile appsStore search matched the brand word in app name / packagePublisher account = the org; package reverse-DNS = an owned domain (
com.<owneddomain>.app
); dev cert; app calls owned API hosts. Mature ASM tools emit an "apps_accepted=0" / ownership-confidence field — read it.
Breach corpora / combosEmail local-or-domain contains the brand wordExact owned-domain match only (
@target.com
), not 
@<word>group.com
/ 
@something<word>.com
. A different domain that contains the word is a different org.
TyposquatsGenerated permutations of the nameThese are defensive/brand-protection findings, not offensive scope — note and move on.
Stack/forum/paste hitsBrand word in bodyBody references the target's real domain/subdomain/employee/secret. Ownership-confidence < threshold = drop.
Recon 来源冲突产生方式归属验证方式
GitHub repos搜索在 repo 名称、主题或某个字符串中匹配到了品牌词Repo 所有者是该组织的 GitHub 组织；提交记录使用组织邮箱；代码引用了该组织的真实域名或基础设施。由随机用户创建的名为 
<word>-backend
的 repo = 噪声。
Cloud buckets（S3/GCS）Bucket 名称位于全局命名空间中；
<word>-static
、
<word>-data
、
<word>-public
对某个人或组织而言都会存在		Bucket 内容引用了目标；bucket 名称与一个已确认的目标子域相关（
x.target.com
↔ 
x-public
）并且内容匹配；检查 ACL/所有者元数据。通用内容（其他语言、其他行业）= 不属于该目标。
Mobile apps应用商店搜索在应用名称或 package 中匹配到了品牌词Publisher 账户属于该组织；package 的 reverse-DNS 对应一个已归属域名（
com.<owneddomain>.app
）；检查开发证书；应用调用已归属的 API 主机。成熟的 ASM 工具会输出 
apps_accepted=0
或所有权置信度字段——需要读取该字段。
Breach corpora / combos邮箱的 local-part 或域名中包含品牌词只接受完全匹配的已归属域名（
@target.com
），不能接受 
@<word>group.com
或 
@something<word>.com
。包含该词的不同域名属于不同组织。
Typosquats根据名称生成的排列组合这些属于防御性/品牌保护发现，不属于攻击测试范围——记录后继续即可。
Stack/forum/paste hits正文中出现品牌词正文引用了目标的真实域名、子域名、员工或 secret。所有权置信度低于阈值 = 丢弃。

Web "Critical" triage — the soft-404 control

Web "Critical" 分流——soft-404 控制

Automated 
.env
/ 
.git
/ 
actuator
/ admin-panel "Criticals" are overwhelmingly soft-404s: SPA/framework catch-alls returning HTTP 200 (or 403) for every path. Verify EACH before believing it:
bash
undefined
自动检测到的 
.env
、
.git
、
actuator
、admin-panel "Criticals" 绝大多数是 soft-404s：SPA/框架的 catch-all 对所有路径都返回 HTTP 200（或 403）。在相信任何发现之前，必须逐项验证：
bash
undefined

the "finding"

the "finding"

curl -s -o /tmp/a -w "%{http_code} %{size_download}\n" https://host.target.com/.env
curl -s -o /tmp/a -w "%{http_code} %{size_download}\n" https://host.target.com/.env

a junk control on the same host

a junk control on the same host

curl -s -o /tmp/b -w "%{http_code} %{size_download}\n" https://host.target.com/zzz-nonsense-$RANDOM
curl -s -o /tmp/b -w "%{http_code} %{size_download}\n" https://host.target.com/zzz-nonsense-$RANDOM

identical byte length / body → FALSE POSITIVE (catch-all), discard

identical byte length / body → FALSE POSITIVE (catch-all), discard

cmp -s /tmp/a /tmp/b && echo "SOFT-404 false positive" || echo "differs — investigate"
Real exposures have a content-type + signature that differs from the catch-all (`.git/config` starts `[core]`; `.env` has `KEY=value`; phpinfo has the XHTML-transitional doctype + `PHP Version`). A physical `.php`/`phpinfo.php` that returns a *bigger/different* body than the junk control is the real-vs-soft-404 tell.

---
cmp -s /tmp/a /tmp/b && echo "SOFT-404 false positive" || echo "differs — investigate"
真实暴露的 content-type 和特征签名应当与 catch-all 不同（`.git/config` 以 `[core]` 开头；`.env` 包含 `KEY=value`；phpinfo 包含 XHTML-transitional doctype 和 `PHP Version`）。实际存在的 `.php`/`phpinfo.php` 返回的正文比垃圾路径对照*更大或不同*，是区分真实暴露与 soft-404 的关键特征。

---

The triage workflow

分流工作流

  1. Confirm the canonical owned-domain set first (the SOW/program domain + its verified subdomains + the verified Entra/Okta/Google tenant brand name). This is your ownership anchor.
  2. For each asset class, apply the verify-by column above. No signal → quarantine, don't test.
  3. Re-baseline the severity counts against only-owned assets. Report the delta — "N Criticals → M after ownership + soft-404 triage" is itself a finding about the ASM program.
  4. Quarantine collisions explicitly (a 
    loot/quarantined_<source>.txt
    ) so it's auditable that you saw them and chose not to target them.
  5. Surface the meta-finding: if the supplied ASM/recon feed is mostly false-positive, that misallocates the owner's remediation budget and buries real risk — write it up (Medium/Strategic).
  1. 首先确认规范的已归属域名集合（SOW/项目域名及其已验证子域，以及已验证的 Entra/Okta/Google tenant 品牌名称）。这是你的所有权锚点。
  2. 针对每类资产，应用上表中的验证方式。 没有任何归属信号 → 隔离，不要测试。
  3. 仅针对已确认归属的资产重新建立严重性计数基线。 报告差值——“N Criticals → M after ownership + soft-404 triage”本身就是一项关于 ASM 项目的发现。
  4. 明确隔离冲突项（写入 
    loot/quarantined_<source>.txt
    ），以便审计时能够确认你看到过这些资产，并有意没有将其作为测试目标。
  5. 呈现元发现（meta-finding）：如果提供的 ASM/recon 数据源主要由误报构成，就会错误分配所有者的修复预算，并掩盖真实风险——应将其记录为 Medium/Strategic。

Anti-patterns

反模式

  • Trusting the tool's "owned" label. Tools keyword-match; they don't prove ownership. Verify.
  • Targeting a same-named third party because it was "in the report." Out of scope + real harm. A combo line 
    user@<word>company.com
    is a different company's employee.
  • Reporting soft-404s as exposures. Always run the junk-path control.
  • Counting typosquats / missing-headers / brand-collision repos as offensive findings. They're defensive/hygiene/noise — they pad the report and erode credibility.
  • Skipping triage "to save time." Untriaged, you spend the whole engagement on other people's assets and find nothing real.
  • 相信工具的“owned”标签。 工具执行的是关键词匹配，而不是证明归属。必须验证。
  • 因为资产出现在报告中，就将其视为同名第三方。 这不在范围内，而且会造成真实伤害。Combo 中的一行 
    user@<word>company.com
    属于另一家公司的员工。
  • 将 soft-404s 作为暴露漏洞报告。 始终运行垃圾路径对照测试。
  • 将 typosquats、缺失安全响应头或品牌冲突 repos 计为攻击类发现。 它们属于防御、治理或噪声，只会虚增报告并削弱可信度。
  • 为了“节省时间”而跳过分流。 不进行分流，就会在整个项目期间耗在其他组织的资产上，最终什么都发现不了。

Why this matters (calibration)

为什么这很重要（校准）

For a target whose brand is a common word, expect the bulk of automated "owned" assets to be collisions:
  • Repos that are unrelated open-source projects (ad-block lists, scrapers, student projects, a different company's SDK) merely containing the word.
  • Mobile apps published by entirely different companies that share the name — banks, credit unions, dating apps, dispensaries, home-care services are all real-world collision categories. (Good ASM tooling will tell you it accepted zero as owned.)
  • Cloud buckets in the global namespace holding some unrelated org's content (other-language documents, demo/sample data, another industry's files).
  • Breach combos full of emails from sibling-named-but-different companies (
    <word>group.com
    , 
    <region><word>.com
    ).
On a real engagement against a dictionary-word brand, after clearing this noise the only genuinely-owned high-severity finding was discoverable solely by manual tradecraft (a JS-bundle → API discovery, see 
hunt-spa-api
) — it was nowhere in the hundreds of scanner "Criticals." Triage-first is what made the engagement productive instead of a goose chase.
对于品牌名属于常见词的目标，应预期自动生成的“owned”资产大多是冲突项：
  • Repos 可能是无关的开源项目（广告拦截列表、抓取工具、学生项目或其他公司的 SDK），只是碰巧包含该词。
  • Mobile apps 可能由完全不同的公司发布，这些公司恰好与目标同名——银行、信用社、约会应用、药房和居家护理服务都是现实中常见的冲突类别。（优秀的 ASM 工具会表明其接受为零个已归属资产。）
  • Cloud buckets 位于全局命名空间中，可能保存着某个无关组织的内容（其他语言的文档、演示或示例数据、其他行业的文件）。
  • Breach combos 中可能充满名称相似但实际不同的公司的邮箱（
    <word>group.com
    、
    <region><word>.com
    ）。
在一次针对词典词品牌的真实 engagement 中，清除这些噪声后，唯一真正归属于目标的高严重性发现，只能通过人工 tradecraft 才能发现（从 JS-bundle → API discovery，参见 
hunt-spa-api
）——它完全没有出现在扫描器报告的数百个 "Critical" 中。首先进行分流，正是让项目富有成效而不是徒劳追踪的关键。

Related Skills & Chains

相关 Skills 与 Chains

  • triage-validation
     — asset-ownership triage (this skill) precedes finding-validity triage (the 7-Question Gate). Ownership first, then validity.
  • redteam-mindset
     — "aggressive default" means probe every owned live surface; this skill defines which surfaces are owned so persistence isn't wasted on collisions.
  • hunt-spa-api
     — once an API host passes ownership triage, this is how you test it.
  • offensive-osint
    / 
    osint-methodology
     — feed ownership anchors (verified domains, tenant brand, dev accounts) from OSINT into this triage.
  • triage-validation
    ——资产归属分流（此 skill）应先于发现有效性分流（7-Question Gate）。先验证归属，再验证有效性。
  • redteam-mindset
    ——“aggressive default”表示应探测每个已确认归属的在线暴露面；此 skill 定义哪些暴露面归目标所有，从而避免在冲突项上浪费时间。
  • hunt-spa-api
    ——API 主机通过归属分流后，使用此 skill 对其进行测试。
  • offensive-osint
    / 
    osint-methodology
    ——将所有权锚点（已验证域名、tenant 品牌、开发人员账户）从 OSINT 输入到此分流流程。