domains / families / security / recon-scope-triage

recon-scope-triage

authentic

Triage ASM/recon output for ownership before testing

When to use

• The target brand is a common/dictionary word or shared term (e.g. `apex`, `summit`, `vertex`, `nova`, `core`, `orbit`, `pulse`, `unity`…)
• You receive an ASM report, recon export, breach combo, repo list, bucket list, or mobile-app list to act on
• A "Critical" count looks implausibly high (hundreds) for the org's size
• Any asset's ownership is asserted by the tool but not *proven*
• **Wasting the engagement** testing/triaging assets that aren't the target's.
• **Attacking an innocent third party** that merely shares the name — out of scope, and real harm.

When not to use

• Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.
• Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.
• Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.

Skill page

Source