# Reconnaissance Output Formats

Asset-specific reconnaissance for Phase 2. Output: `outputs/{engagement}/reconnaissance/`.

## Directory Structure

```
├── reconnaissance_report.md
├── assets/{domains|web-applications|api-endpoints|network-services|cloud-resources}.json
└── raw/  # Tool outputs (nmap, ffuf, zap)
```

## Format 1: domains.json

```json
{
  "asset_type": "domain",
  "target": "example.com",
  "subdomains": [
    {"name": "api.example.com", "ip_addresses": ["192.0.2.1"], "status": "live",
     "tech_stack": ["nginx/1.21.0"], "discovery_method": "certificate_transparency"}
  ],
  "dns_records": {"mx": [], "txt": [], "ns": []},
  "stats": {"total_subdomains": 15, "live_subdomains": 12}
}
```

## Format 2: web-applications.json

```json
{
  "asset_type": "web_application",
  "target": "https://app.example.com",
  "technology_stack": {"frontend": ["React 18.2.0"], "backend": ["Express.js 4.18.0"]},
  "endpoints": [{"path": "/api/v1/users", "method": "GET", "params": ["id"], "auth_required": true}],
  "forms": [{"location": "/profile", "inputs": ["name", "email"], "file_upload": true}],
  "javascript_files": [{"url": "/static/js/main.js", "endpoints_found": ["/api/v1/users"]}],
  "cookies": [{"name": "session_token", "secure": true, "httponly": true}],
  "stats": {"total_endpoints": 45, "input_fields": 127}
}
```

## Format 3: api-endpoints.json

```json
{
  "asset_type": "api",
  "target": "https://api.example.com",
  "api_type": "REST",
  "documentation": {"swagger": "https://api.example.com/swagger.json"},
  "authentication": {"methods": ["Bearer Token"], "endpoints": {"login": "/api/v1/auth/login"}},
  "endpoints": [
    {"path": "/api/v1/users/{id}", "methods": ["GET", "PUT"],
     "params": {"path": ["id"], "query": ["fields"]}, "auth_required": true, "rate_limit": "100/minute"}
  ],
  "graphql": {"endpoint": "/graphql", "introspection_enabled": true, "mutations": ["createUser"]},
  "stats": {"total_endpoints": 67, "authenticated_endpoints": 55}
}
```

## Format 4: network-services.json

```json
{
  "asset_type": "network_services",
  "target": "192.0.2.1",
  "hostname": "web01.example.com",
  "os_detection": {"name": "Linux", "version": "Ubuntu 22.04"},
  "open_ports": [
    {"port": 22, "service": "ssh", "version": "OpenSSH 8.9p1",
     "cve_candidates": ["CVE-2023-38408"], "risk_level": "medium"},
    {"port": 3306, "service": "mysql", "exposed_to_internet": true, "risk_level": "high"}
  ],
  "stats": {"open_ports": 8, "high_risk_services": 1}
}
```

## Format 5: cloud-resources.json

```json
{
  "asset_type": "cloud_infrastructure",
  "provider": "aws",
  "s3_buckets": [
    {"name": "example-backups", "public_access": true, "encryption": null, "risk_level": "critical"}
  ],
  "ec2_instances": [
    {"instance_id": "i-abc123", "ip_public": "192.0.2.10", "security_groups": ["sg-web"], "open_ports": [22, 443]}
  ],
  "stats": {"public_buckets": 1, "total_instances": 5}
}
```

## reconnaissance_report.md
The Reconnaissance report file will contains the following structure: 
- `Executive summary`: List of all discovered assets.
- `Stats`: a list of stats as follow: 
  - `Assets`: Total count of primary assets discovered
  - `High-risk items`: Count of high-risk items requiring immediate attention
  - Coverage metrics (e.g., live vs. total subdomains)
- `Risk-prioritized findings`: Critical → low (ordered by severity).
- `Technology stack`: Summary with version information for each technology.
- `External exposure map`: Overview of internet-facing services.
- `Authentication entry points`: Locations where authentication occurs.
- `Data input vectors`: List of forms, APIs, file upload functionalities.
- `Reconnaissance logs`: A list of all the tools and jobs executed to collect these information grouped by asset

## Critical Rules
- Generate all inventory JSON files (one per asset type discovered)
- Save raw tool outputs in `outputs/{engagement}/reconnaissance/raw/` directory with the name of the asset + the name of the tool
