Security Reconnaissance
Attack surface discovery and research for red teams and cybersecurity researchers
Start anywhere, discover everything
Most reconnaissance tools work in one direction: you enter a domain or IP and get a list back. That's fine when you already know what you're looking for. It's useless when you don't—and it can't answer questions like "show me every router in this country running this software" or "find all the infrastructure that shares a certificate authority with this target." Those questions require a knowledge graph, not a search bar.
Oscar lets you start from whatever you have—a domain, an IP, an ASN, a geographic region, a certificate pattern, a port configuration—and follow connections across the internet's logical and physical layers. Enter a certificate and discover every domain it covers. Enter an ASN and see every prefix, every downstream dependency, every facility where that network's traffic lands. The Mosaic holds all of this in one place, so you don't spend your time correlating across six different tools.
Start from any identifier
Domain, IP, ASN, geography, certificate, or infrastructure pattern. Oscar converts between asset types: a certificate becomes domains, domains become IPs, IPs become routing infrastructure.
Expand through connections
Follow dependencies to discover related infrastructure. Pattern matching reveals entities with similar characteristics. The Mosaic connects logical and physical layers automatically.
Map the surface
Identify vulnerabilities, misconfigurations, and exposures across everything you've found. Fingerprinting reveals specific software versions and implementations.
Understand the architecture
Traceroute data shows routing paths and chokepoints. Identify dependencies, international connectivity, and the infrastructure relationships that define how resilient—or fragile—a network really is.
Discovery beyond enumeration
Standard tools enumerate assets. Oscar reveals how they fit together. Historical data shows operational patterns: how an organization responds to vulnerabilities, when they perform maintenance, how quickly they patch. Traceroute data exposes routing dependencies invisible to conventional scanning—the exchange point where traffic bottlenecks, the transit provider whose route change could redirect your target's traffic.
This is reconnaissance as research, not enumeration. Every answer in The Mosaic connects to the next question. A certificate leads to domains you didn't know existed. Those domains resolve to IPs on an ASN you haven't looked at yet. That ASN peers through a facility in a country that changes your assessment entirely.