Attack surface mapping

Scope first — enumeration is reconnaissance, and recon has rules

This lesson lives inside an authorized engagement. Reconnaissance — MITRE ATT&CK groups it as tactic TA0043 — is the first thing an attacker does and the first thing you do, but the enumeration techniques here only apply to assets that are in your signed scope. “We own the example.com domain” is not the same as “we are authorized to test every host that resolves under it” — a subdomain might be a third-party SaaS (status.example.com pointing at a vendor’s status page) that your scope document explicitly excludes. Before you enumerate, you confirm what’s in bounds; when enumeration discovers something unexpected, the next move is to check it against scope, not to probe it. The discovery itself — “this host exists and is exposed” — is the deliverable. Everything in this lesson is the kind of passive and light-touch enumeration you run against your own authorized estate to see what you actually expose.

The reason this matters so much: most organizations cannot tell you, accurately, what they have on the internet. Cloud accounts spin up in minutes, teams register subdomains without telling security, acquisitions bring whole inherited estates, and a “temporary” demo box outlives the project by years. The attacker doesn’t care which of these was intentional. They enumerate everything, find the weakest exposed thing, and start there.

Attack surface = every reachable entry point, intended or not

The attack surface is the complete set of points where an attacker could attempt to interact with your systems: every domain and subdomain that resolves, every open port and service, every API endpoint and parameter, every cloud bucket and storage account, every third-party integration, and — at the edges — every credential and employee that touches the system. “Reachable” is the operative word. A beautifully hardened production cluster doesn’t shrink your surface by one byte if a forgotten staging host on the same VPC is wide open.

Enumeration is the disciplined process of discovering that surface so you can measure and reduce it. It runs in three intertwined passes — find the assets, expand each asset into its subdomains and services, and surface the shadow IT nobody is tracking.

The three enumeration passes

Asset discovery answers “what do we own?” before “what does it expose?” You start from seeds — a root domain, a company name, a known IP block — and pivot outward. WHOIS and registrar data reveal sibling domains; published ASN and IP-range registrations (RIR records) reveal owned network blocks; cloud-provider account inventories reveal what’s running where; certificate transparency logs (every TLS certificate ever issued is logged publicly) reveal hostnames the moment a cert is minted for them. The senior insight: asset discovery is mostly an open-source intelligence exercise — the data is already public, because the act of putting something on the internet leaves a public trail (a DNS record, a cert, an ASN registration). You’re not breaking in; you’re reading the trail the organization left.

Subdomain enumeration expands each owned domain into its real, resolving hosts. Two complementary methods cover it. Passive enumeration pulls names from sources that already recorded them — certificate transparency logs are the heavy hitter, because a wildcard or per-host cert leaks the hostname publicly the moment it’s issued; passive DNS aggregators and search-engine indexes add more. Active enumeration resolves candidate names — brute-forcing a wordlist of common prefixes (dev, staging, api, vpn, admin) against DNS, and trying the zone-transfer misconfiguration that, when present, hands you the entire zone at once. Passive is quiet and authorization-friendly because you query third-party datasets, not the target; active is noisier and touches the target’s DNS directly, so it belongs more firmly inside the engagement’s rules of engagement.

Shadow IT is the pass that finds what no inventory knows about — and it’s where the real findings hide. Shadow IT is any system, service, or account running outside the organization’s sanctioned, tracked inventory: the SaaS a marketing team signed up for with a corporate card, the personal cloud project that holds real customer data, the contractor’s leftover VM, the subdomain pointing at a deprovisioned service (a dangling DNS record, which is a subdomain-takeover waiting to happen when someone re-registers the orphaned target). It exists because shipping is easy and decommissioning is nobody’s job. The attacker loves it precisely because nobody is patching, monitoring, or even remembering it.

Reading the map like a senior

The output of enumeration isn’t a trophy list of hosts — it’s a prioritized picture of exposure. A senior reads it by asking, for each discovered asset: is this supposed to be exposed, who owns it, and is it defended to the standard the data behind it deserves? The dangerous quadrant is “exposed + unowned + undefended,” and shadow IT lives there by definition. The defensive payoff of doing this offensively is that you’re forced to see your estate the way an attacker does — flat, complete, and indifferent to your org chart — instead of the way your architecture diagram flatters you into seeing it.

Enumeration also has a tradeoff axis a senior manages deliberately: passive techniques are quiet, low-risk, and stay off the target, but they only surface what’s already been published somewhere; active techniques find the unpublished hosts but touch the target’s infrastructure and generate noise that can trip detection — which, on an authorized engagement, may be exactly what you want to test, and on a careless one is how you cause an incident.