Asset Discovery

Path: /discovery · Sidebar: Assets → Discovery

Discovery finds the attack surface you didn't know you had. Give it a root domain and it enumerates subdomains and live hosts, then lets you promote real assets into targets - and verify you own them before scanning.

Run a discovery job

1. Click New Discovery and enter a root domain (e.g. example.com).
2. Choose the techniques to run:
   • Certificate Transparency - subdomains from public CT logs.
   • DNS enumeration - common records and resolvers.
   • Brute-force - wordlist-based subdomain guessing.
   • Live probe - which discovered hosts actually respond.
3. Start the job. Progress streams live.

Discovery detail

Path: /discovery/[id]

The detail page lists discovered hosts with their resolution status and whether they are live. From here you can promote a host into a scannable target.

Domain-ownership verification

Before a discovered domain can be scanned, apPosture can require ownership verification (a DNS TXT record or file token). This is a fail-closed gate that prevents accidentally scanning systems you don't control.

Ownership gate

In some lab environments the ownership gate is disabled via RECON_REQUIRE_OWNERSHIP=false. Re-enable it before production use so only verified domains can be scanned.

From discovery to scanning

1. Run discovery on your domain.
2. Verify ownership of the hosts you intend to test.
3. Promote each verified host to a target, attaching it to an application.
4. Run a DAST scan.