Map a Target’s Attack Surface with OSINT (Quick Start)

Aug 30, 2025 · 1 min read · Guides

Graph of domains and services
Graph of domains and services

OSINT Attack Surface (Quick Start)

We’ll chain Subfinder, httpx, and Naabu.

Steps

  1. Enumerate subdomains
  2. Probe & resolve
  3. Scan ports
  4. Prioritize findings

Tip: Save raw outputs; they’re gold for diffing later.