References & Exposure

Analyst Toolkit

What the application did, and what it mentions.

Referenced domains, hostnames, URLs, email addresses and phone numbers found inside the captured content, separated from what was actually contacted. They represent intent, infrastructure, and sometimes accidental disclosure.

The previous sections describe what the application did. This one describes what it mentions. Code and pages routinely contain addresses, hostnames and contact details that were never used during the capture: a backup server, a staging environment, an internal system, a developer's address. None of it shows in a traffic report, because none of it was traffic.

Integrated Reports

  • Referenced Domains

    Every domain name appearing anywhere in the captured content, with where it was found, and a filter separating referenced from contacted. A domain written into your code that was never called is worth a look, because it will be called eventually, by someone.

  • Referenced Hostnames

    The same at hostname precision, with associated server addresses where known. Finer grained than the domain view and better at surfacing internal naming conventions that were never meant to ship.

  • Referenced URLs

    Every full address found inside the content, with its source, the file it was found in, and how many times it was actually called. Where hard coded endpoints, forgotten test environments, and configured but dormant integrations come to light.

  • Email Addresses

    Addresses discovered inside pages, code and responses, with where each was found. A standard finding in a security review: they feed targeted phishing, they reveal organizational structure, and they are often left behind accidentally.

  • Phone Numbers

    Telephone numbers found in the same material, with their country identified and where each was found. Same rationale as email addresses: a direct line embedded in a public asset is an exposure worth knowing about.

Analyst Toolkit

One capture is enough to start

Capture a session in the browser, import it, and read what comes back. A free community account is available immediately.

Start Free Request a Demo