This skill complements recon-full(active scanning): recon-full is responsible for "discovery", while target-profiling is responsible for "analysis and organization". If reconnaissance has not been done yet, execute recon-full first.
Phase 1: Data Aggregation
Use evidence_list(filter asset records by type) and list_vulns to obtain existing reconnaissance data. If the data is insufficient, additionally execute:
subfinder -d domain/ksubdomain -d domain— Subdomainsnaabu -host target— Ports (nmap as an alternative)httpx -u target -tech-detect/curl -sI target— Fingerprinting
Phase 2: Attack Surface Analysis
2.1 Technology Stack Distribution
Count the technology stacks used by the target and identify uniformly managed and independently deployed systems:
- Unified framework (e.g., Spring Boot across the entire site) → one vulnerability may affect all systems
- Mixed technology stacks → evaluate each system independently
2.2 Exposure Surface Assessment
Classify discovered services by risk level:
Extremely high risk(should be attacked first):
- Management backends (admin/manager/console)
- Development/testing environments (dev/staging/test)
- Exposed database ports (3306/5432/6379/27017)
- CI/CD systems (Jenkins/GitLab/Harbor)
High risk：
- Components with known vulnerabilities (old versions of Spring/Struts/Log4j)
- Authentication pages (may have weak passwords/default credentials)
- API endpoints (may lack authentication)
Medium risk：
- Standard web applications (require further manual testing)
- Email/VPN entry points (entry points for social engineering attacks)
Low risk：
- CDN/static resources
- Purely presentational websites
2.3 Network Topology Inference
Infer the network structure from subdomains and IP distribution:
- Same IP range → possibly the same data center/VPC
- Real IP behind a CDN → may bypass the WAF
- Mixed internal and external deployment → potential paths for lateral movement
Phase 3: Output Target Profile
Generate a structured report, including:
- Asset inventory: domain/IP/port/service/version
- Technology stack overview: framework/middleware/CMS distribution
- Attack priority: list of attack targets sorted by risk level
- Recommended attack paths: based on the discovered information, recommend 2-3 attack paths most likely to succeed
- Information gaps: aspects that still require further reconnaissance
Network Topology Inference
- Subnet analysis: 10.0.1.x may be the web segment (web servers in the same subnet), and 10.0.2.x may be the database segment (different subnet, with network isolation)
Information Gap Identification
- Single source of subdomains: lacks OSINT and lacks crawlers, resulting in insufficient coverage
- Incomplete ports: the default Top 1000 ports are not enough; a full-port (65535) scan is needed
- Non-standard ports (30000+) and high ports may hide services