External Infrastructure Reconnaissance

Map an explicitly authorized organization's external attack surface by passively collecting candidate subdomains, then sending bounded TCP SYN and HTTP(S) probes to in-scope hosts. Subfinder's configured passive sources support victim network information gathering (T1590); the Nmap and httpx probes perform active scanning (T1595). Outputs identify candidates and observed service responses; they do not prove ownership, vulnerability, or the absence of services outside the selected sources and ports.