Reconnaissance and attack surface

You cannot defend what you do not know you have. Attackers start by mapping the target; defenders who run the same discovery first find the forgotten server before it is used against them.

nmapamass / subfinderhttpxShodan / Censyscertificate transparency (crt.sh)masscan

What recon covers

Passive: gathering information without touching the target's systems, such as public records, DNS data, certificate transparency logs, search engines and leaked-credential reports.
Active: interacting with the target to learn more, such as port scans and service probes. Only within scope, and at a rate agreed in the .
Assets: domains, subdomains, IP ranges, cloud resources, applications, APIs and third-party services.
People and process (when in scope): public information about roles and technology that shapes how an attacker would approach.

Mapping your own surface

Run this against assets you own or are authorized to test. The same commands show an attacker what is visible, and show a defender what should be turned off.

surface-discovery.sh (authorized targets only)bash

# 1. subdomains from passive sources
subfinder -d example.com -silent > subs.txt

# 2. which of them answer on the web, with title and technology
httpx -l subs.txt -title -tech-detect -status-code -silent > web.txt

# 3. open ports and service versions on an in-scope host, at a polite rate
nmap -sV -T3 --top-ports 1000 --max-rate 100 -oA scans/web01 203.0.113.10

# 4. certificate transparency: names that were ever issued a certificate
curl -s 'https://crt.sh/?q=%25.example.com&output=json' | jq -r '.[].name_value' | sort -u

What to look for

Forgotten assets: old staging servers, test domains, retired products still answering.
Exposed administrative interfaces and databases, and services that should not be on the internet at all.
Outdated versions and default configurations revealed by banners.
Cloud resources open to the world: storage, snapshots, dashboards.
Subdomains that point to services you no longer control ().
Secrets and internal details in public code, documents and error pages.

Defender's view

Treat this as continuous asset management, not a one-off test. Keep an authoritative inventory, run external discovery on a schedule, compare it with the inventory, and investigate every difference. Reduce the surface: close what is not needed, put administrative access behind a VPN or zero-trust gateway, and remove dangling DNS records.

Alert when a new internet-facing asset appears that is not in the inventory.
Assign an owner to every asset; an unowned asset is a risk.
Retire things properly: remove DNS, certificates and cloud resources together.

Rules of engagementRoEThe agreed document that turns permission into practical limits: scope, time window, forbidden actions, rate, emergency contacts and how findings are reported.see in glossary →Subdomain takeoverA DNS record pointing to a cloud or SaaS resource that no longer exists, which someone else can claim and serve content from your domain.see in glossary →

connections on the map

Penetration testing methodologystarts withReconnaissance and attack surface
Reconnaissance and attack surfacefeedsWeb and API security testing

updated on 14/10/2026 · sources to go deeper · report an error

in other domains

CSPM - cloud posturecloudsecwhat the attacker sees from outside, CSPM sees from inside

Study before

Penetration testing methodology

test what you learned

Loading questions…