Challenge
Reconnaissance tools produce useful but disconnected files. The analyst still has to normalize hosts, explain why one target matters more than another, compare runs, and prepare evidence for review.
Project case study
SurfaceLens
A local-first attack-surface workbench for turning common recon output into explainable priorities.
Context
Why it exists and what I built.
Design decision
Keep the workflow local and make prioritization inspectable. SurfaceLens stores normalized observations, ranking reasons, snapshot drift, and analyst notes in one workspace instead of hiding the decision inside a score.
Contribution
Designed and built the normalization, explainable ranking, snapshot comparison, annotation, and multi-format export flow.
Outcome
The MVP turns common reconnaissance output into a repeatable analyst review surface with four export formats and a visible reasoning trail.
How it works
Four stages from input to evidence.
Ingest
Read common reconnaissance outputs without sending them to a hosted service.
Normalize
Bring hosts, services, and observations into one inspectable model.
Prioritize
Rank leads with visible heuristics that an analyst can challenge.
Export
Carry annotations and reasoning into HTML, Markdown, JSON, and CSV.
Evidence and limits
What the source supports.
What the project demonstrates
- The reviewed source contains four unit tests.
- Exports are available in HTML, Markdown, JSON, and CSV.
- Snapshot comparison and analyst annotations remain part of the local workflow.
What the project does not claim
- There is no public CI workflow or formal release.
- The MVP is not presented as production-ready for untrusted input.
- Ranking is decision support; an analyst still validates every target and conclusion.
CyberKareem/surfacelensSource snapshot at commit fe7269ce87c4460a7c0aef5d7209385584955a40. Later repository changes are outside this case study.
Inspect pinned revision opens in a new tab