Start Here

Get what you need in 30 seconds or less — the fastest path to the right command, tool, or scenario card.

🚀 ASM Quick Reference Hub

Get what you need in 30 seconds or less!

📋 Quick Navigation

By Experience Level

🟢 Beginner? Start Here - Your first ASM scan in 5 minutes
🟡 Practitioner Resources - Ready-to-use commands and scripts
🔴 Advanced Techniques - Enterprise and automation solutions

By Task

🔍 Find Subdomains - Quick subdomain discovery
🌐 Check Live Hosts - Identify active services
📸 Take Screenshots - Visual reconnaissance
🔌 Scan Ports - Service discovery

By Resource Type

📄 Command Cheat Sheet - Copy-paste commands for every ASM tool
🎯 Scenario Cards - Phased command sequences for real situations
📊 Recon Tools / Cloud Tools - Compare ASM tools at a glance
⚡ Advanced Techniques - WAF bypass, anomaly detection, multi-cloud discovery
🐳 Docker Quickstart - Zero-install toolkit

🟢 Beginner: Start Here

Your First ASM Scan in 5 Minutes

# 1. Install essential tool (one-time setup)
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest

# 2. Find subdomains (replace example.com with YOUR domain)
subfinder -d example.com -silent > subdomains.txt

# 3. Check which are live
curl -s https://raw.githubusercontent.com/projectdiscovery/httpx/master/install.sh | bash
cat subdomains.txt | httpx -silent > live_hosts.txt

# 4. View results
echo "Found $(wc -l < subdomains.txt) subdomains"
echo "$(wc -l < live_hosts.txt) are live"
cat live_hosts.txt

⚠️ IMPORTANT: Only scan domains you own or have permission to test!

🟡 Practitioner Resources

Most Used Commands

Find Subdomains Quick

# Fast passive discovery (safe, no direct contact)
subfinder -d target.com -all -silent | tee subdomains.txt

# With multiple sources
amass enum -passive -d target.com | tee -a subdomains.txt

Check Live Hosts Quick

# Basic check
cat subdomains.txt | httpx -silent -status-code

# With details
cat subdomains.txt | httpx -title -tech-detect -status-code

Take Screenshots Quick

# Install gowitness
go install github.com/sensepost/gowitness@latest

# Take screenshots
gowitness file -f live_hosts.txt

Scan Ports Quick

# Top 100 ports (respectful timing)
nmap -iL hosts.txt --top-ports 100 -T2 --max-rate 50

🔴 Advanced Techniques

Automation Pipeline

# Complete ASM pipeline in one command
subfinder -d target.com -silent | httpx -silent | nuclei -t exposures/ -silent

API Integration

# Shodan search
shodan search "org:Target Corp" --fields ip_str,port,product

# GitHub recon
gh api search/code -q "target.com" --jq '.items[].html_url'

Cloud Enumeration

# AWS S3 buckets
aws s3 ls s3://target-bucket --no-sign-request

# Azure blob storage
./gobuster dir -u https://targetcorp.blob.core.windows.net -w wordlist.txt

📚 Complete Resources

Full Documentation - Comprehensive ASM guide
Tool Guides - Detailed tool documentation
Automation Scripts - Ready-to-use automation
Learning Path - Structured learning

🆘 Need Help?

Quick Start Issues? Check Troubleshooting
Legal Questions? Read Security Considerations
Community Support: GitHub Discussions