ankur@sec:~$

$ whoami

Ankur Khunt · Developer turned Security Engineer

Attackers don’t start with your code. They start with what’s public about you.

I’m a developer turned pentester. I show developers how attackers map an attack surface with OSINT - subdomains, old endpoints, leaked versions, public code - and how to find and shrink their own before someone else does.

./recon-yourself./lookup your-domain
  1. [crt.name] www.example.com
  2. [crt.name] staging.example.com nginx/1.18.0
  3. [shodan] 22/tcp OpenSSH 7.4 open
  4. [subfinder] api.example.com
  5. [harvester] 40 emails · first.last@ format
  6. [crt.name] old-admin.example.com 200 OK
  7. [httpx] /.git/HEAD 200 OK
  8. [wayback] /api/v1/users?id= still live
  9. [github] AWS key in a 2023 commit
  10. [done] 9 doors · 3 forgotten · 3 exposed · 0 packets sent to app

● known● forgotten● exposed● people

## what your browser just told me

You haven't clicked anything or allowed any permission. This is what this page can already read about you - the same starting point trackers and attackers use.

$ passive-recon --target you

    JavaScript is off, so this page can read much less about you. That's good OPSEC.

    Nothing here leaves your browser: this site has no analytics, no cookies and no server. Close the tab and it's gone. Want to reduce it? Firefox's resist fingerprinting, Brave, or Tor Browser make most of these values generic.

    ## how an attack actually starts

    1. 01 · osintWhat's publicCertificates, old URLs, GitHub, job posts, headers
    2. 02 · attack surfaceThe doors it revealsForgotten subdomains, old APIs, versions, exposed files
    3. 03 · owasp top 10What they tryBroken access control, misconfiguration, injection…
    4. 04 · fixWhat you do firstThe same tools, pointed at yourself

    Most security training starts at step 3, inside the code. I start at step 1 - from outside, the way an attacker finds you.

    ## start here

    basics

    What is attack surface?

    Every subdomain, endpoint, header and dependency is a door. Known, unknown and forgotten.

    osint

    How attackers map you

    Eleven public sources, what each one reveals, and which vulnerability it leads to.

    hands-on

    Recon yourself in 30 minutes

    A step-by-step checklist with copy-paste commands. Type your domain once.

    automate

    One line. One script.

    A no-install one-liner, and recon.sh: an in-depth scan with a local HTML report.

    no install

    Attack surface lookup

    29 public services, your domain pre-filled. Just click.

    ## owasp top 10 (2025), from the outside in

    Each risk explained for developers: why it happens, how attackers find it with OSINT, how it's abused, and how to fix it - with JavaScript and C# examples.

    ## who's writing this

    I spent my first years building healthcare and device-management platforms with Angular, React, .NET and Docker. In August 2024 a senior asked if I was interested in security. Now I break the kind of apps I used to build - and explain it in developer language. → the full story