loading
Loading content
loading
Attack Surface Management
Probe hostnames, IPs, or CIDR on common HTTP ports and keep the live web servers with title, redirect, status, server header, CDN, and TLS. The web-tail entry for recon pipelines.
A raw list of hostnames, IPs, or CIDR ranges is mostly dead weight. This module probes the common HTTP ports on every entry, drops the names that don't answer, and returns a typed bundle per live web server (title, redirect, status, server header, CDN, and full TLS) ready to nest into the next step of a recon or attack-surface pipeline. One pass also harvests new hostnames from TLS SAN, CSP, and redirect targets, so the output feeds the next enumeration.
You have a list of hostnames, IPs, or CIDR ranges. Most of it is dead. Probe the most likely HTTP ports on every entry, keep the ones that answer, and write a details bundle per live server: title, status, TLS, CDN. Extra hostnames in TLS SAN, CSP, and redirects are a side output, not hostname enumeration. This is the web-tail entry: hosts -> probe-web -> web FP -> tech-specific. A 200 is a live HTTP answer, not a finding. A harvested hostname is a hint, not a confirmed in-scope name.
Pipeline guidance
Do not cross-wire into the network tail:
web-servers. Path crawling, technology-specific checks, and the scan report sit after fingerprint, not on raw hosts.hosts input. That is the network-tail entry. This is the web-tail entry. They share upstream. They do not share output.Dedupe and re-scope harvested hostnames, then feed them back as hosts. That loop is optional. It is not hostname enumeration.
Nest this after you have a host list from DNS or OSINT, and before any web fingerprinting, path discovery, or technology-specific scan. If you still need unpublished names, enumerate first. If you need CMS, CDN, or WAF names, fingerprint after this, on the live URL list this emits.
hosts (FILE). Hostnames, IP addresses, or IP ranges, one per line.
header (STRING). Header(s) to include in HTTP requests.
header-file (FILE). File of header(s) to include in HTTP requests.
web-servers: live web server URLs. This is what the next web-tail step nests on.
web-server-details: JSONL per live server. Details include title, status, TLS, and CDN, plus redirects, length, favicon, and server header. The module keeps paths and queries from the input when they are present.
Hostname harvest (side output, not an enumerator): subdomains / subdomain-details, potential-hostnames / potential-hostname-details, subdomain-wildcards / subdomain-wildcard-details, and potential-hostname-wildcards / potential-hostname-wildcard-details. Names come from TLS SAN and CN, CSP, and redirect targets. potential-* rows are outside strict scope.
The tables this module produces. Sample rows are illustrative.
Live web server URLs. This is what the next web-tail step nests on.
urlurl | |
|---|---|
| 1 | https://example.com |
| 2 | https://api.example.com |
| 3 | http://staging.example.com:8080 |
JSONL record per live server. The typed bundle the next step nests on.
timestampdatetime | portint | urlurl | inputtext | schemetext | webservertext | methodtext | hosttext | pathtext | status_codeint | content_lengthint | titletext | cdnbool | cdn_nametext | tlsjson | headersjson | |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | 2026-08-13T20:14:03Z | 443 | https://example.com | example.com | https | nginx | GET | example.com | / | 200 | 1280 | Example | true | cloudflare | {3} | {3} |
| 2 | 2026-08-13T20:14:04Z | 443 | https://blog.example.com | blog.example.com | https | nginx | GET | blog.example.com | / | 301 | 0 | Example Blog | true | cloudflare | {3} | {2} |
| 3 | 2026-08-13T20:14:05Z | 8080 | http://staging.example.com:8080 | staging.example.com:8080 | http | apache | GET | staging.example.com | / | 401 | 384 | Unauthorized | false | NULL | NULL | {2} |
Hostnames discovered from the HTTP response (TLS SAN, CSP, redirects). Side output, not an enumerator.
hostnametext | data_sourcetext | contexttext | linked_assettext | |
|---|---|---|---|---|
| 1 | www.example.com | tls-san | certificate subjectAltName | example.com |
| 2 | assets.example.com | csp | Content-Security-Policy directive | example.com |
| 3 | redirect.example.com | redirect | 301 Location header | example.com |
Probe for Web Servers
Artifact class it owns
Live HTTP(S) URLs and a details bundle (title, status, TLS, CDN)
Upstream it needs
Hosts
Artifact class it owns
Protocol, banner, product
Upstream it needs
port-details from open-ports
Artifact class it owns
Technology taxonomy on live web URLs
Upstream it needs
web-servers from this module
Artifact class it owns
Hostnames pulled from a crawl
Upstream it needs
Live web-servers
questions
parallel network-tail entry, not this job
Drop this module into a Trickest workflow and connect it to your upstream and downstream nodes. The face contract above is the wiring.
Get a personalized demo
A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.