recon-scope-triage

Verify ownership by requiring concrete signals per asset class: repos owned by the org's GitHub org, buckets whose content correlates with confirmed subdomains, apps published under the org's account, and breach emails matching the exact owned domain. Keyword matches alone never prove ownership.

Detect soft-404s by requesting the reported path (e.g., /.env) and a random junk path on the same host, then comparing response size and body. Identical responses mean a catch-all is faking the finding; differing content with real signatures like [core] or KEY=value indicates a genuine exposure.

ASM tools keyword-match on the brand name across global namespaces like GitHub, S3 bucket names, and app stores. For common-word brands, unrelated same-named companies produce repos, buckets, apps, and breach combos that the tool labels as owned without proof.

Run ownership triage at the very start of an engagement, immediately upon receiving any ASM, recon, or OSINT dataset, before testing anything. Skipping it risks spending the engagement on third-party assets and attacking out-of-scope organizations.

Quarantine unverified assets into an auditable file such as loot/quarantined_<source>.txt rather than testing them. This documents that collisions were reviewed and deliberately excluded, and the re-baselined severity delta itself becomes a reportable finding about the ASM program.