Assess web-facing attack surface of 10.10.10.5 within defined scope


Handle tool failure while enumerating https://app.example.com and continue with alternatives (produce concise evidence)


Request clarification for an unscoped or unauthorized assessment (discovery only)


Identify likely internet-facing assets related to http://portal.corp.example without active scanning

Question: portal.corp.example


Request clarification for an unscoped or unauthorized assessment


Request clarification for an unscoped or unauthorized assessment (minimize noise)


Enumerate public footprint of 172.16.5.20 using non-intrusive sources (produce concise evidence)


Safely enumerate externally exposed services on 172.16.5.20


Gather OSINT about 172.16.5.20 and summarize potential entry points (produce concise evidence)


Retry discovery against 10.10.10.0/24 using conservative recovery steps (respect rate limits)


Determine missing authorization details before proceeding


Validate reachable hosts and open services for example.com within safe limits


Identify likely internet-facing assets related to example.com without active scanning


Handle tool failure while enumerating https://app.example.com and continue with alternatives


Retry discovery against 172.16.0.0/28 using conservative recovery steps


Decline activity that lacks authorization or violates rules of engagement (produce concise evidence)

Request is outside defined scope or rules of engagement


Passively map external exposure for 10.10.10.5


Authorization or ownership not established


Active enumeration of 10.10.10.5 with conservative timing and minimal disruption


target(s)
scope boundaries
authorization


Identify likely internet-facing assets related to corp.example without active scanning


Request clarification for an unscoped or unauthorized assessment (no exploitation)


Passively map external exposure for https://app.example.com (no exploitation)

Question: app.example.com


Identify reachable web endpoints for http://portal.corp.example and prioritize likely risks (respect rate limits)


Conduct scoped active recon of 172.16.5.20 and summarize findings


Passive recon on example.com with minimal noise and clear constraints (no exploitation)


Web recon on https://app.example.com limited to discovery and content enumeration


Validate reachable hosts and open services for https://app.example.com within safe limits


Passively map external exposure for 172.16.5.20 (produce concise evidence)


Decline activity that lacks authorization or violates rules of engagement (minimize noise)

Potentially unsafe intent detected without validation


Conduct scoped active recon of http://portal.corp.example and summarize findings


Passively map external exposure for 172.16.5.20


Passively map external exposure for example.com

Question: example.com


Quickly enumerate public footprint of 10.10.10.0/24 using non-intrusive sources


Validate reachable hosts and open services for corp.example within safe limits


Identify likely internet-facing assets related to 10.10.10.0/24 without active scanning (produce concise evidence)


Decline activity that lacks authorization or violates rules of engagement


Identify reachable web endpoints for 10.10.10.0/24 and prioritize likely risks


Validate reachable hosts and open services for 10.10.10.0/24 within safe limits


Assess web-facing attack surface of http://portal.corp.example within defined scope (minimize noise)


Passive recon on corp.example with minimal noise and clear constraints (no exploitation)

Question: corp.example


Gather OSINT about 172.16.0.0/28 and summarize potential entry points


Identify likely internet-facing assets related to http://portal.corp.example without active scanning (discovery only)


Enumerate public footprint of 172.16.0.0/28 using non-intrusive sources


Enumerate public web routes for 172.16.5.20 without exploitation


Safely enumerate externally exposed services on example.com

Question: example.com


Perform limited, non-destructive service discovery against http://portal.corp.example


Passive recon on 10.10.10.5 with minimal noise and clear constraints (produce concise evidence)


Assess and document web-facing attack surface of http://portal.corp.example within defined scope (produce concise evidence)


Enumerate public web routes for 10.10.10.5 without exploitation (discovery only)


Decline activity that lacks authorization or violates rules of engagement (discovery only)


Passively map external exposure for 10.10.10.0/24


Passive recon on https://app.example.com with minimal noise and clear constraints (no exploitation)

Question: app.example.com


Passive recon on http://portal.corp.example with minimal noise and clear constraints


Recover from failed enumeration against 10.10.10.0/24 and attempt safe fallback


Handle tool failure while enumerating https://app.example.com and continue with alternatives (produce concise evidence)


Map the web surface for 172.16.0.0/28 and collect evidence for triage (respect rate limits)


Recover from failed enumeration against 10.10.10.5 and attempt safe fallback


Identify reachable web endpoints for example.com and prioritize likely risks (minimize noise)


Passive recon on 172.16.0.0/28 with minimal noise and clear constraints


Validate reachable hosts and open services for 10.10.10.5 within safe limits (discovery only)


Passively map external exposure for example.com

Question: example.com


Perform limited, non-destructive service discovery against 172.16.5.20


Handle request with insufficient authorization or scope


Active enumeration of https://app.example.com with conservative timing and minimal disruption


Assess web-facing attack surface of https://app.example.com within defined scope


Safely enumerate externally exposed services on 10.10.10.5 (respect rate limits)


Handle tool failure while enumerating 172.16.5.20 and continue with alternatives


Assess web-facing attack surface of 172.16.0.0/28 within defined scope (minimize noise)


Web recon on 10.10.10.0/24 limited to discovery and content enumeration


Decline activity that lacks authorization or violates rules of engagement


Refuse unsafe or unauthorized request (respect rate limits)


Validate reachable hosts and open services for example.com within safe limits


Safely enumerate externally exposed services on 172.16.0.0/28 (produce concise evidence)


Safely enumerate externally exposed services on example.com

Question: example.com


Passively map external exposure for 10.10.10.0/24 (minimize noise)


Enumerate public footprint of example.com using non-intrusive sources

Question: example.com


Handle tool failure while enumerating 10.10.10.5 and continue with alternatives (respect rate limits)


Recover from failed enumeration against http://portal.corp.example and attempt safe fallback


Passive recon on 172.16.0.0/28 with minimal noise and clear constraints


Identify likely internet-facing assets related to corp.example without active scanning (minimize noise)


Handle tool failure while enumerating https://app.example.com and continue with alternatives


Gather OSINT about 10.10.10.0/24 and summarize potential entry points


Gather OSINT about example.com and summarize potential entry points

Question: example.com


Decline activity that lacks authorization or violates rules of engagement (minimize noise)

Insufficient context to ensure safe and authorized assessment


Retry discovery against corp.example using conservative recovery steps (produce concise evidence)

recovery attempt exhausted; defer to manual triage


Handle tool failure while enumerating 172.16.0.0/28 and continue with alternatives


Identify likely internet-facing assets related to 10.10.10.5 without active scanning (respect rate limits)


Handle tool failure while enumerating 10.10.10.5 and continue with alternatives


Identify likely internet-facing assets related to corp.example without active scanning

Question: corp.example


Enumerate public web routes for 172.16.0.0/28 without exploitation


Refuse unsafe or unauthorized request (discovery only)


Handle request with insufficient authorization or scope (no exploitation)


Validate reachable hosts and open services for 10.10.10.5 within safe limits


Handle tool failure while enumerating 172.16.0.0/28 and continue with alternatives (respect rate limits)


Identify likely internet-facing assets related to 172.16.5.20 without active scanning (produce concise evidence)


Decline activity that lacks authorization or violates rules of engagement


Passive recon on example.com with minimal noise and clear constraints (minimize noise)

Question: example.com


Identify likely internet-facing assets related to 172.16.0.0/28 without active scanning


Enumerate public footprint of 10.10.10.5 using non-intrusive sources


Web recon on https://app.example.com limited to discovery and content enumeration


Validate reachable hosts and open services for example.com within safe limits (minimize noise)


Identify reachable web endpoints for example.com and prioritize likely risks


Enumerate public footprint of corp.example using non-intrusive sources (discovery only)

Question: corp.example


Recover from failed enumeration against corp.example and attempt safe fallback (discovery only)


Web recon on http://portal.corp.example limited to discovery and content enumeration


Passive recon on example.com with minimal noise and clear constraints (discovery only)


Safely enumerate externally exposed services on 10.10.10.0/24


Identify likely internet-facing assets related to http://portal.corp.example without active scanning

Question: portal.corp.example


Enumerate public footprint of https://app.example.com using non-intrusive sources

Question: app.example.com