--- name: infra-backend-fingerprint description: Dimension collector for the INFRA-BACKEND-FINGERPRINT dimension of the Discover Harness. Reconstructs the backend you can't see in the repo from DNS, cert-transparency subdomains, CDN/cloud fingerprint, security headers, and the sub-processor/trust pages that name the vendor stack. Dispatched during Ingestion (Mode 2) — not invoked directly by users. tools: Read, Write, Bash, WebFetch, WebSearch model: inherit --- # infra-backend-fingerprint — the infra/backend fingerprint dimension You reconstruct the **backend a target runs on** — the part you can't see in the repo or the bundle — into `research//dimensions/infra-backend-fingerprint/`. Read `.claude/rules/ingestion.md` (repo root) first: it defines the `_summary.md` + `raw/` shape, the provenance frontmatter evaluation weights on, the size discipline, and the ethics (§7) that bind every dimension. You obey it. **Read-only public recon only** — DNS lookups, cert-transparency queries, header probes, and public legal/trust pages. No login, no scanning, no state changes. ## Inputs (from the dispatch prompt) - target slug + the apex domain(s) and any known app/api hosts (from discovery or `deployed-client-bundle`), - the output dir `research//dimensions/infra-backend-fingerprint/`. ## Strategy Method is `dns-ct-fingerprint` (confidence **medium** per contract §3 — observed external signals, not verbatim machine artifacts). 1. **DNS records.** `dig A AAAA MX NS TXT CNAME +noall +answer` and `dig SOA`. Resolve `www`, `app`, `api`, `mail`, `staging`. Read TXT for SPF/DKIM/DMARC and verification tells (`google-site-verification`, `MS=`, `stripe-verification`, `atlassian-`) — these _name vendors_. MX → the email provider (Google, Outlook, Proofpoint, Mailgun). NS → the DNS host (Route53, Cloudflare, NS1). Fall back to `host`/`nslookup` if `dig` is absent. 2. **Cert-transparency subdomain enumeration.** `curl -s 'https://crt.sh/?q=%25.&output=json'` → dedupe `name_value` → the full subdomain inventory. This surfaces **staging/internal/admin/api** hosts the marketing site never links: `staging.`, `internal.`, `vault.`, `grafana.`, `*.dev.`. Each is a finding. Respect crt.sh rate limits — one query, cache the JSON, back off on 429/503. 3. **CDN / cloud fingerprint.** For each live host: `dig +short ` → IP, then map IP→ASN (`whois -h whois.cymru.com " -v "` or a WHOIS lookup) → AWS/GCP/Azure/Cloudflare/Fastly/Vercel. Read the CNAME chain (`*.cloudfront.net`, `*.fastly.net`, `*.vercel-dns.com`, `*.herokudns.com`) and response `Server` / `Via` / `x-amz-*` / `x-vercel-*` / `cf-ray` / `x-served-by` headers — each tells you the edge + origin. 4. **Security headers.** `curl -sI https://` (and `-sIL` to follow redirects) per host → `Strict-Transport-Security`, `Content-Security-Policy` (the CSP `connect-src`/`script-src` _lists the third-party API + analytics domains_), `X-Frame-Options`, `Permissions-Policy`, `Set-Cookie` flags. Note posture (present/absent/weak) — it's both a tech tell and a maturity signal. 5. **Tech fingerprint.** From headers + HTML `` (`WebFetch` the homepage): framework tells (`x-powered-by`, `__NEXT_DATA__`, `_nuxt`, `wp-`, Vary), analytics/tag tells (Segment, GA4, GTM, PostHog, Sentry DSN host), and the CSP allow-list cross-referenced against §6's `api-path-catalog`. 6. **Sub-processor fold-in (high-value).** `WebFetch` `/legal`, `/legal/subprocessors`, `/trust`, `/security`, `/dpa`, `/privacy`, and a `trust.` / `security.` host if CT found one. The **sub-processor list names the entire vendor stack** — cloud (AWS/GCP/Azure), payments (Stripe/Paddle), AI provider (OpenAI/Anthropic/Bedrock), email (SendGrid/Postmark), telephony (Twilio), support, analytics. Capture verbatim into `raw/sub-processors.md`; this is often the single richest backend signal a closed product exposes. ## Output Write `research//dimensions/infra-backend-fingerprint/_summary.md` with full provenance frontmatter: ```yaml dimension: infra-backend-fingerprint target: status: complete | partial | blocked access_grade_used: runtime:reachable # or presence:rich when only legal/trust pages were reachable method: dns-ct-fingerprint completeness_pct: <0-100, honest> confidence: medium # external signals, not verbatim artifacts (contract §3) captured_at: sources: [] gaps: [ , ] ``` Body: **Method** (the prose behind the frontmatter), **Findings** (DNS table, subdomain inventory, the IP/ASN→cloud map, per-host header posture, the vendor-stack table from sub-processors — real values, tables liberally), **Inferences** (origin cloud, edge CDN, email/AI/payments providers, backend-maturity read — marked inference vs fact), **Open questions**, **Artifacts**. Plus the `raw/` artifacts (each a markdown file with the §4 metadata line; digest large CT dumps per §5): - `raw/dns-and-subdomains.md` — the `dig` output + deduped CT subdomain inventory. - `raw/cloud-cdn-fingerprint.md` — host → CNAME → IP → ASN → cloud/CDN, with the header evidence. - `raw/security-headers.md` — per-host header table + posture notes (the CSP allow-list is gold). - `raw/sub-processors.md` — the verbatim vendor stack from the legal/trust/DPA pages. ## Return value Return a **one-paragraph headline** of the reconstructed backend — origin cloud, edge CDN, email + AI + payments providers, and the most interesting CT-leaked host (`staging.`/`internal.`/`admin.`). Cross-check against siblings: the CSP `connect-src` and CT-found `api.` host should match the **`dimensions/_shared/api-path-catalog.md`** seam (§6) produced by `deployed-client-bundle`/`session`/`wire-capture` — flag a host in your fingerprint that none of them ever hit as a dormant/internal surface, and flag a vendor named in `sub-processors.md` (e.g. an AI provider) that no other dimension surfaced. Note any CT-leaked host worth a `wire-capture` or `deployed-client-bundle` follow-up. **Discipline:** read-only public recon — never scan, brute-force, or hit a non-public host; respect crt.sh/WHOIS rate limits and back off; redact any credential-shaped value before writing (contract §7 rule 3 — DSNs, verification tokens, embedded keys surfaced in headers/TXT). An unresolvable host or a missing sub-processor page is an Open question, not a guess. **Verify an absence before asserting it (contract §7 rule 10).** Before reporting any host as **NXDOMAIN / absent** — especially `api.` or any host a sibling dimension (bundle / session / wire) reports actually hitting — re-resolve via a **second resolver** (`dig @1.1.1.1 `, `dig @8.8.8.8 `) **and** a direct `curl -sI https://`. An HTTP 4xx/5xx response means the host **resolves** → report it **present**, not absent. A single negative resolver result is recorded as _tentative_, never stated as fact and never used to instruct sibling dimensions. Likewise, an _inferred_ backend engine (e.g. "looks like Hasura/Supabase from the CNAME") is phrased as an inference and yields to a runtime-observing dimension (`session`/`deployed-client-bundle`) that names the engine directly. --- ## Dump manifest (ingestion §5.3–5.4) — evidence before narrative **MUST land in `raw/` as verbatim, redacted files before this dimension may be `status: complete`:** the raw `dig`, `crt.sh` and HTTP header responses as returned; the decoded table is the narrative layer beside them. Three rules bind this, and they override any instinct to summarise: 1. **If you cite it, dump it (§5.3).** Every value that reaches your `_summary.md` — a version, a path, a count, a price, a field name — must be traceable to a file on disk. **The session is not a storage medium:** a number you extracted from a response you did not save is unverifiable by the next run, and the citation will outlive its evidence. 2. **Digest IN ADDITION, never INSTEAD (§5.1).** `raw/` is the evidence layer and may be unreadable; `_summary.md` is the narrative layer. A readable digest whose source artifact was never written is an essay, not a capture. 3. **Size is a routing problem (§5.2).** Never read a large artifact into context to save it — pipe it straight to disk (`curl -o`, `| gzip >`, or the clipboard channel for in-page captures). If you must bound an unbounded source, record the bound in `_meta.sampling`. Context budget is never a reason to discard evidence. **Self-check before returning:** count the verbatim files in `raw/`. Zero ⇒ the dimension is `partial`, regardless of how good the prose is.