This is what we actually do.
Every. Single. Engagement.
What follows is a complete, phase-by-phase breakdown of how Lucretia conducts an External Attack Surface Management engagement — from the first passive recon query to the final validated deliverable. No marketing language. No ambiguity. This is the process.
Before we touch a single host, we know more about your external footprint than most of your own team does. Phase 01 is entirely passive — nothing we do here is detectable. We are building a complete picture of your organization's internet-facing presence using publicly available data, commercial intelligence feeds, and open-source tooling — all before issuing a single packet toward your infrastructure.
Commercial internet scan indexes queried by org name, domain, and IP range — before we send a single packet toward your infrastructure.
Passive subdomain enumeration across 75+ public sources simultaneously — no DNS brute force, no noise, just what's already publicly known.
Organization registration records, IP range ownership, and ASN attribution mapped before any scanning begins. We establish the full legitimate IP space — and look for what's missing from it.
Multi-source OSINT aggregator pulling email addresses, hostnames, and IPs from search engines, LinkedIn, Hunter.io, and passive DNS services.
Breach database and dark web index queries are available as an add-on to any engagement. We find out what attackers already have before a single packet is sent. Contact us to include this in your scope.
Historical web crawl archives surface endpoints, parameters, and subdomains that no longer appear in DNS or sitemaps — but are still live.
Passive GitHub repository scan searching for secrets and credentials committed to public repos associated with your organization or domain.
Subdomain enumeration runs against 75+ passive sources simultaneously. We are not brute-forcing DNS — we are aggregating what is already publicly known.
Every SSL/TLS certificate issued by a public CA is logged in the CT ledger. We mine this to find every domain and subdomain your organization has ever had a cert issued for.
Credential exposure checks are available as an add-on to any engagement. We search breach databases and public repositories for data belonging to your domain before a single packet is sent. Contact us to include this in your scope.
Every host confirmed in RECON is scanned across the full 65,535-port range. Not the top 1,000. Not the top 10,000. All of them. Attackers don't limit themselves to well-known ports — neither do we. Every open port is interrogated: service version, protocol, banner, SSL presence, and OS fingerprint.
Full 65,535-port SYN scan on every in-scope host. Host-alive checks are bypassed — if it's in scope, it gets scanned regardless of ping response.
Dedicated TLS/SSL enumeration run independently against every port presenting a certificate — not just 443. Covers the full cipher and protocol surface.
Second-pass TLS analysis run independently from SSLScan. Cross-checks cipher results and adds protocol-level attack surface testing.
HTTP/HTTPS probe across every open port — not just standard web ports. Maps every web application in scope, including those running on unexpected ports.
WAF and reverse proxy detection across all web-responding hosts. Knowing what's in front of a target informs how the rest of the assessment is structured.
Dedicated SSH service analysis run against every SSH port in scope. Version detection alone isn't enough — algorithm support is what determines actual exposure.
OWASP ZAP with AJAX spider runs against every web-responding host — passive mode first, then active probing. Covers dynamic content that static crawlers miss.
Web server misconfiguration scanner targeting server-level exposure — not application logic. Runs against every HTTP/HTTPS port identified by httpx.
Endpoint discovery across every web application in scope — Katana crawls what's live, GAU surfaces what was once public. Together they map the full reachable surface.
JavaScript dependency vulnerability scanner. Fetches client-side JS from every live target and checks each library against a maintained CVE database of known-vulnerable versions.
Wordlist-driven content and directory discovery against every web-responding host. Goes deeper than passive crawling to find paths that are present but never linked.
Null-session enumeration against Windows file sharing ports (139/445) using enum4linux-ng and rpcclient. Identifies what an unauthenticated attacker can extract without credentials.
Raw scan output is triaged by analysts. Every identified service version is cross-referenced against CVE databases. Every web application is probed for security header misconfigurations, injection points, and client-side exposures. Scanner noise is discarded. Only findings with genuine risk potential advance.
Beyond matching against static databases, Lucretia maintains live threat feeds that run daily against your asset inventory. If a service discovered on your infrastructure appears in CISA's known-exploited catalog or in NIST's recent HIGH/CRITICAL feed, you are alerted before your next scheduled assessment cycle — not after.
This is where most EASM vendors stop — and where we start. A finding in our system does not exist until it can be proven. Not inferred. Not flagged. Proven, with a specific command, against a specific host and port, producing real output that directly demonstrates the vulnerability.
Every assessed finding must pass through the validation gate before it can advance. The gate requires:
Every VALIDATED finding is subjected to a second, independent confirmation pass using a different tool and a different method. If the second method contradicts the first, the finding is pulled — not reported. This is the gate that eliminates false positives entirely, and no other EASM vendor runs this process at scale.
No tool is infallible. A single tool's output can reflect a momentary condition, a parsing error, or a false match. We treat each VALIDATED finding as a hypothesis that must be independently confirmed before it earns the right to appear in a client deliverable.
The VERIFY phase is designed to be adversarial — it actively fights to disprove findings. The following conditions cause a finding to be pulled:
For a TLS 1.0 finding, the two methods look like this:
| VALIDATE RESULT | VERIFY RESULT | VERDICT | ACTION |
|---|---|---|---|
| CONFIRMED ✓ | CONFIRMED ✓ | VERIFIED | Ships in report |
| CONFIRMED ✓ | NOT REPRODUCED ✗ | CONFLICT | Manual analyst review → likely pulled |
| NOT CONFIRMED ✗ | N/A | NOT_VALIDATED | Does not advance to Verify |
| CONFIRMED ✓ | NO METHOD AVAILABLE | HUMAN REVIEW | Analyst documents reason, senior review required |
Only confirmed, genuinely exploitable findings reach this phase — and nothing here happens automatically. Where the engagement scope authorizes it, an operator exploits a finding to prove real-world impact. Not "this could be exploited," but "here is exactly what an attacker gets." Every action is human-triggered, human-confirmed, and logged as evidence.
Exploitation is the one phase that can change the state of a target, so it is the one phase the platform will never run on its own. It is a deliberate, authorized, per-finding decision made by a human.
For each exploitable finding, the platform pre-fills the exact command, maps it to MITRE ATT&CK, and states what it yields. The operator launches it from the console and interacts with live sessions.
Once access is proven, the operator works a structured post-exploitation checklist and records exactly what the foothold exposes.
The deliverable is not a list of scanner output with your logo on it. It is a structured, prioritized, evidence-packed document where every claim is backed by a reproducible proof command. Your team — or your clients — can verify every single finding themselves, using the commands we provide.
Every phase documented above runs inside a purpose-built engagement platform. Each step is tracked, time-stamped, and linked to the findings it produces. Nothing falls through the cracks.
The Lucretia platform is a purpose-built engagement management system that runs every phase of an EASM assessment from first passive recon hit to final signed report. It is not a scanner dashboard or a third-party integration — it is the operational core of how we work.
Every finding, every proof command, every validation result, and every verification pass is recorded, time-stamped, and linked to the specific host and port it came from. The platform enforces the methodology — findings cannot advance to the next phase without meeting the requirements of the current one.
The result is a complete, auditable engagement record that backs every deliverable we produce.
