EXTERNAL ATTACK SURFACE DISCOVERY
You get the list of internet-facing assets you actually expose, including the ones no inventory has.
What you get
Everything recon found, as one graph. Each node is a host, endpoint, credential or finding.
platform.
Scoped Report
Attack surface, competitive intelligence, M&A diligence, brand monitoring, or a baseline to diff against later.
Machine-Readable File
Domains, certificates, IPs, Shodan results, and summary counts, as JSON.
Per-Record Provenance
Each subdomain carries the source that found it and its last-seen date.
Degraded Source Status
If DNSDB or Shodan fails or runs out of quota, the run continues and logs it.
Passive means passive.
Domain Recon is a collection playbook. It builds the asset picture and hands it to whatever runs next. These are its rules, taken from the playbook's own scope section.
No packet reaches the target
No port scan, no HTTP probe, no DNS brute force, no active fingerprinting of any kind.
Ten domains per run, maximum
A larger estate splits across runs; the playbook stops and asks rather than silently truncating.
No exploitation. Discovery ends at the ranked asset list
Proving a listed exposure is real is a different playbook against an actively authorized scope.
Active enumeration is not included
amass, httpx, theHarvester, holehe and sherlock are Tentacle tools a user installs and runs deliberately.
No remediation. Cracken does not patch a host, rotate a certificate, or take anything offline
It tells you what is exposed and where the data came from.
Who this is for
Start testingHead of Security Engineering
Shadow deployments, forgotten subdomains and a decade of acquisitions are all in scope for an attacker and none of them are in your asset register.
Red Team Lead
You want the external footprint enumerated the way an adversary sees it, not the way the inventory remembers it.
CISO
Your inventory is a spreadsheet maintained by people who have left. You need the real edge of the estate.
Questions
Does Cracken send any traffic to my domains during external attack surface discovery?
No. The Domain Recon playbook is passive by scope rule: port scans, HTTP probes, and DNS brute force are prohibited inside it. Every finding comes from a third-party record, so the target sees nothing.
How is this different from an EASM product?
An EASM product is a monitoring subscription that watches an estate. Domain Recon is a playbook you point at a named scope, which returns two artifacts and hands its asset list to the next playbook in the operation. The recon exists to feed an attack, not to fill a dashboard.
Can Cracken run active reconnaissance if I want it?
Yes, but not inside Domain Recon. Active tools including amass and httpx install onto a Tentacle from the integration catalog and run under the same scope on human command, as a separate operation with its own authorization.
My asset inventory already lists what we expose. What does discovery add?
An inventory records what somebody remembered to record. CISA's July 2026 water-sector alert names the gap directly: external connections including cellular modems installed by operators, vendors or system integrators that may not be documented or included in routine attack surface scans. Discovery reconstructs the footprint from third-party records instead of reading it off your list. — Alert: CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs (CISA, 30 July 2026)
Run the recon on a domain you own.
Name a domain inside your scope and start the Domain Recon playbook.