ankur@sec:~$

$ whoami

Ankur Khunt · Developer turned Security Engineer

Attackers don’t start with your code. They start with what’s public about you.

I’m a developer turned pentester. I show developers how attackers map an attack surface with OSINT - subdomains, old endpoints, leaked versions, public code - and how to find and shrink their own before someone else does.

./recon-yourself./lookup your-domain
  1. [crt.name] www.example.com
  2. [crt.name] staging.example.com nginx/1.18.0
  3. [shodan] 22/tcp OpenSSH 7.4 open
  4. [subfinder] api.example.com
  5. [harvester] 40 emails · first.last@ format
  6. [crt.name] old-admin.example.com 200 OK
  7. [httpx] /.git/HEAD 200 OK
  8. [wayback] /api/v1/users?id= still live
  9. [github] AWS key in a 2023 commit
  10. [done] 9 doors · 3 forgotten · 3 exposed · 0 packets sent to app

● known● forgotten● exposed● people

## how an attack actually starts

  1. 01 · osintWhat's publicCertificates, old URLs, GitHub, job posts, headers
  2. 02 · attack surfaceThe doors it revealsForgotten subdomains, old APIs, versions, exposed files
  3. 03 · owasp top 10What they tryBroken access control, misconfiguration, injection…
  4. 04 · fixWhat you do firstThe same tools, pointed at yourself

Most security training starts at step 3, inside the code. I start at step 1 - from outside, the way an attacker finds you.

## start here

basics

What is attack surface?

Every subdomain, endpoint, header and dependency is a door. Known, unknown and forgotten.

osint

How attackers map you

Eleven public sources, what each one reveals, and which vulnerability it leads to.

hands-on

Recon yourself in 30 minutes

A step-by-step checklist with copy-paste commands. Type your domain once.

automate

One line. One script.

A no-install one-liner, and recon.sh: an in-depth scan with a local HTML report.

no install

Attack surface lookup

29 public services, your domain pre-filled. Just click.

## owasp top 10 (2025), from the outside in

Each risk explained for developers: why it happens, how attackers find it with OSINT, how it's abused, and how to fix it - with JavaScript and C# examples.

## who's writing this

I spent my first years building healthcare and device-management platforms with Angular, React, .NET and Docker. In August 2024 a senior asked if I was interested in security. Now I break the kind of apps I used to build - and explain it in developer language. → the full story