<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-attack-surface-discovery
description: >-
  Discover and map organizational attack surface including external assets,
  shadow IT, exposed services, certificates, DNS records, and cloud resources
  using automated reconnaissance techniques.
domain: cybersecurity
subdomain: vulnerability-management
tags:
  - attack-surface
  - asset-discovery
  - reconnaissance
  - shadow-it
  - nuclei
  - subfinder
  - external-exposure
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1595"]
---

# Performing Attack Surface Discovery

## Overview

You cannot protect what you do not know exists. Attack surface discovery identifies
all externally accessible assets — subdomains, IP ranges, exposed services, cloud
resources, certificates, and shadow IT — before attackers find them. This skill
covers passive and active discovery techniques using subfinder, amass, nuclei,
Shodan, and certificate transparency logs.

Mode: `[MODE: RECON]` — Reconnaissance and asset discovery.

## Prerequisites

| Requirement | Details |
|---|---|
| `subfinder` — passive subdomain enumeration | Required |
| `httpx` — HTTP probing and technology detection | Required |
| `nuclei` — template-based scanning | Required |
| `nmap` — port scanning and service detection | Required |
| Shodan API key for internet-wide search | Required |
| Python 3.10+ with `requests` | Required |

## Key Concepts

### Discovery Pipeline

```bash
# Phase 1: Passive subdomain enumeration
subfinder -d target.com -all -silent -o /tmp/subdomains.txt

# Phase 2: DNS resolution and filtering
cat /tmp/subdomains.txt | dnsx -silent -a -resp -o /tmp/resolved.txt

# Phase 3: HTTP probing
cat /tmp/subdomains.txt | httpx -silent -status-code -title -tech-detect \
  -o /tmp/live_hosts.txt

# Phase 4: Port scanning on live hosts
nmap -sV -sC --top-ports 1000 -iL /tmp/live_ips.txt -oA /tmp/nmap_results

# Phase 5: Vulnerability scanning with nuclei
nuclei -l /tmp/live_hosts.txt -t cves/ -t exposures/ -t misconfigurations/ \
  -severity critical,high -o /tmp/nuclei_findings.txt
```

### Certificate Transparency Monitoring

```bash
# Query crt.sh for certificate transparency logs
curl -s "https://crt.sh/?q=%.target.com&output=json" | \
  jq -r '.[].name_value' | sort -u | grep -v '\*' > /tmp/ct_subdomains.txt

# Monitor for new certificates (delta detection)
curl -s "https://crt.sh/?q=%.target.com&output=json" | \
  jq -r '.[] | select(.not_before >= "2026-03-01") | .name_value' | sort -u
```

### Shodan Reconnaissance

```bash
# Search for organization's assets
curl -s "https://api.shodan.io/shodan/host/search?key=$SHODAN_KEY&query=org:\"Target Corp\"" | \
  jq '.matches[] | {ip: .ip_str, port: .port, product: .product}'

# Check specific IP
curl -s "https://api.shodan.io/shodan/host/1.2.3.4?key=$SHODAN_KEY" | \
  jq '{ports, vulns, os}'

# Search for exposed services
curl -s "https://api.shodan.io/shodan/host/search?key=$SHODAN_KEY&query=ssl.cert.subject.cn:target.com" | \
  jq '.matches[] | {ip: .ip_str, port: .port, product: .product}'
```

### Cloud Asset Discovery

```bash
# AWS: List public-facing resources
aws ec2 describe-instances --filters "Name=ip-address,Values=*" \
  --query 'Reservations[].Instances[].{ID:InstanceId,IP:PublicIpAddress,DNS:PublicDnsName}'

# AWS: List public S3 buckets
aws s3api list-buckets --query 'Buckets[].Name' | while read bucket; do
  aws s3api get-bucket-acl --bucket "$bucket" 2>/dev/null | \
    jq "select(.Grants[].Grantee.URI==\"http://acs.amazonaws.com/groups/global/AllUsers\") | {bucket: \"$bucket\"}"
done

# Azure: List public IPs
az network public-ip list --query '[].{name:name, ip:ipAddress, fqdn:dnsSettings.fqdn}'
```

## Workflow

### Step 1: Run Discovery Pipeline

```bash
node scripts/agent.js --action discover \
  --domain target.com \
  --output /tmp/attack_surface.json
```

### Step 2: Identify New Assets (Delta)

```bash
node scripts/agent.js --action delta \
  --current /tmp/attack_surface.json \
  --baseline /tmp/previous_surface.json \
  --output /tmp/new_assets.json
```

### Step 3: Risk-Score Assets

```bash
node scripts/agent.js --action score \
  --input /tmp/attack_surface.json \
  --output /tmp/surface_risk.json
```

## Detection

```yaml
title: Attack Surface Discovery Detection
id: bfb5db3c-6f41-4c74-9b2d-b0110fccafa3
status: experimental
description: Detects suspicious activity related to performing attack surface discovery techniques in vulnerability management context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*attack*"
  condition: selection
level: medium
tags:
  - attack.t1595
  - attack.discovery
falsepositives:
  - Vulnerability scanner performing scheduled assessment scans
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Attack Surface Discovery Detection | windows/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1595 |

## Verification

- [ ] All registered domains included in discovery scope
- [ ] Subdomain enumeration running daily with delta detection
- [ ] Certificate transparency monitoring active
- [ ] Cloud asset inventory synchronized with discovery results
- [ ] Shadow IT assets identified and risk-assessed
- [ ] External service exposure reviewed weekly

## References

- [ProjectDiscovery subfinder](https://github.com/projectdiscovery/subfinder)
- [ProjectDiscovery nuclei](https://github.com/projectdiscovery/nuclei)
- [Shodan API Documentation](https://developer.shodan.io/api)
- [MITRE ATT&CK T1595 — Active Scanning](https://attack.mitre.org/techniques/T1595/)
- [CISA — Attack Surface Management](https://www.cisa.gov/attack-surface-management)
