This is what we actually do.
Every. Single. Engagement.
What follows is a complete, phase-by-phase breakdown of how Lucretia conducts an External Attack Surface Management engagement — from the first passive recon query to the final validated deliverable. No marketing language. No ambiguity. This is the process.
Before we touch a single host, we know more about your external footprint than most of your own team does. Phase 01 is entirely passive — nothing we do here is detectable. We are building a complete picture of your organization's internet-facing presence using publicly available data, commercial intelligence feeds, and open-source tooling — all before issuing a single packet toward your infrastructure.
Commercial internet scan indexes queried by org name, domain, and IP range — before we send a single packet toward your infrastructure.
Passive subdomain enumeration across 75+ public sources simultaneously — no DNS brute force, no noise, just what's already publicly known.
Organization registration records, IP range ownership, and ASN attribution mapped before any scanning begins. We establish the full legitimate IP space — and look for what's missing from it.
Multi-source OSINT aggregator pulling email addresses, hostnames, and IPs from search engines, LinkedIn, Hunter.io, and passive DNS services.
Breach database and dark web index queries run against your domain before any active phase begins. We find out what attackers already have.
Historical web crawl archives surface endpoints, parameters, and subdomains that no longer appear in DNS or sitemaps — but are still live.
Subdomain enumeration runs against 75+ passive sources simultaneously. We are not brute-forcing DNS — we are aggregating what is already publicly known.
Every SSL/TLS certificate issued by a public CA is logged in the CT ledger. We mine this to find every domain and subdomain your organization has ever had a cert issued for.
Before any scanning, we check whether credentials belonging to your domain are already circulating in breach data or accessible in public repositories.
Every host confirmed in RECON is scanned across the full 65,535-port range. Not the top 1,000. Not the top 10,000. All of them. Attackers don't limit themselves to well-known ports — neither do we. Every open port is interrogated: service version, protocol, banner, SSL presence, and OS fingerprint.
Full 65,535-port SYN scan on every in-scope host. Host-alive checks are bypassed — if it's in scope, it gets scanned regardless of ping response.
Dedicated TLS/SSL enumeration run independently against every port presenting a certificate — not just 443. Covers the full cipher and protocol surface.
Second-pass TLS analysis run independently from SSLScan. Cross-checks cipher results and adds protocol-level attack surface testing.
HTTP/HTTPS probe across every open port — not just standard web ports. Maps every web application in scope, including those running on unexpected ports.
WAF and reverse proxy detection across all web-responding hosts. Knowing what's in front of a target informs how the rest of the assessment is structured.
Dedicated SSH service analysis run against every SSH port in scope. Version detection alone isn't enough — algorithm support is what determines actual exposure.
OWASP ZAP with AJAX spider runs against every web-responding host — passive mode first, then active probing. Covers dynamic content that static crawlers miss.
Web server misconfiguration scanner targeting server-level exposure — not application logic. Runs against every HTTP/HTTPS port identified by httpx.
Endpoint discovery across every web application in scope — Katana crawls what's live, GAU surfaces what was once public. Together they map the full reachable surface.
Raw scan output is triaged by analysts. Every identified service version is cross-referenced against CVE databases. Every web application is probed for security header misconfigurations, injection points, and client-side exposures. Scanner noise is discarded. Only findings with genuine risk potential advance.
This is where most EASM vendors stop — and where we start. A finding in our system does not exist until it can be proven. Not inferred. Not flagged. Proven, with a specific command, against a specific host and port, producing real output that directly demonstrates the vulnerability.
Every assessed finding must pass through the validation gate before it can advance. The gate requires:
Every VALIDATED finding is subjected to a second, independent confirmation pass using a different tool and a different method. If the second method contradicts the first, the finding is pulled — not reported. This is the gate that eliminates false positives entirely, and no other EASM vendor runs this process at scale.
No tool is infallible. A single tool's output can reflect a momentary condition, a parsing error, or a false match. We treat each VALIDATED finding as a hypothesis that must be independently confirmed before it earns the right to appear in a client deliverable.
The VERIFY phase is designed to be adversarial — it actively fights to disprove findings. The following conditions cause a finding to be pulled:
For a TLS 1.0 finding, the two methods look like this:
| VALIDATE RESULT | VERIFY RESULT | VERDICT | ACTION |
|---|---|---|---|
| CONFIRMED ✓ | CONFIRMED ✓ | VERIFIED | Ships in report |
| CONFIRMED ✓ | NOT REPRODUCED ✗ | CONFLICT | Manual analyst review → likely pulled |
| NOT CONFIRMED ✗ | N/A | NOT_VALIDATED | Does not advance to Verify |
| CONFIRMED ✓ | NO METHOD AVAILABLE | HUMAN REVIEW | Analyst documents reason, senior review required |
The deliverable is not a list of scanner output with your logo on it. It is a structured, prioritized, evidence-packed document where every claim is backed by a reproducible proof command. Your team — or your clients — can verify every single finding themselves, using the commands we provide.
Every phase documented above runs inside a purpose-built engagement platform. Each step is tracked, time-stamped, and linked to the findings it produces. Nothing falls through the cracks.
The Lucretia platform is a purpose-built engagement management system that runs every phase of an EASM assessment from first passive recon hit to final signed report. It is not a scanner dashboard or a third-party integration — it is the operational core of how we work.
Every finding, every proof command, every validation result, and every verification pass is recorded, time-stamped, and linked to the specific host and port it came from. The platform enforces the methodology — findings cannot advance to the next phase without meeting the requirements of the current one.
The result is a complete, auditable engagement record that backs every deliverable we produce.
