<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-attack-surface-management
description: >-
  Continuously discover, inventory, and monitor external attack surfaces using
  subfinder, httpx, nuclei, and Shodan. Covers asset discovery, exposure monitoring,
  shadow IT detection, and risk scoring for internet-facing infrastructure.
domain: cybersecurity
subdomain: vulnerability-management
tags:
  - attack-surface-management
  - asset-discovery
  - external-exposure
  - shadow-it
  - subdomain-enumeration
  - shodan
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1595"]
---

# Implementing Attack Surface Management

## Overview

Attack Surface Management (ASM) continuously discovers and monitors all internet-facing
assets — including shadow IT, forgotten subdomains, expired certificates, and exposed
services. Unlike periodic vulnerability scanning, ASM provides continuous visibility
into what attackers can see from the outside.

## Prerequisites

| Requirement | Install |
|---|---|
| subfinder | `go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest` |
| httpx | `go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest` |
| nuclei | `go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest` |
| naabu | `go install -v github.com/projectdiscovery/naabu/v2/cmd/naabu@latest` |
| Shodan CLI | `pip install shodan` |
| Python 3.10+ | Agent tooling |

## Key Concepts

### Subdomain Discovery

```bash
# Passive subdomain enumeration
subfinder -d example.com -all -o subdomains.txt

# Recursive subdomain discovery
subfinder -d example.com -recursive -all -o subdomains_recursive.txt

# Multi-domain discovery
subfinder -dL domains.txt -all -o all_subdomains.txt

# Resolve and filter live subdomains
cat subdomains.txt | httpx -status-code -title -tech-detect \
  -json -o live_subdomains.json
```

### Port Scanning

```bash
# Fast port scan on discovered subdomains
naabu -l subdomains.txt -top-ports 1000 -o open_ports.txt

# Full port scan on high-value targets
naabu -l critical_hosts.txt -p - -o full_ports.txt

# Combine with httpx for web service detection
naabu -l subdomains.txt -top-ports 100 | httpx -json -o web_services.json
```

### Exposure Monitoring

```bash
# Shodan host search for organization
shodan search "org:Example Corp" --fields ip_str,port,product --separator , > shodan_assets.csv

# Shodan monitor — continuous alerting
shodan alert create "Example Corp" 203.0.113.0/24
shodan alert triggers --enable new_service,open_database,vulnerable

# nuclei exposure scan
nuclei -l live_subdomains.txt \
  -tags exposure,misconfig,takeover \
  -severity critical,high -json -o exposure_findings.json

# Certificate transparency monitoring
curl -s "https://crt.sh/?q=%.example.com&output=json" | \
  jq -r '.[].name_value' | sort -u > ct_subdomains.txt
```

### Shadow IT Detection

```bash
# Compare discovered assets against known inventory
comm -23 <(sort subdomains.txt) <(sort known_assets.txt) > shadow_it.txt

# Check for subdomain takeover opportunities
nuclei -l subdomains.txt -tags takeover -json -o takeover_findings.json

# Detect cloud resources by CNAME
dig +short CNAME $(cat subdomains.txt) | grep -E "amazonaws|azure|cloudfront|herokuapp"
```

### SSL/TLS Certificate Assessment

```bash
# Check certificate expiration across all assets
cat live_subdomains.txt | while read host; do
  EXPIRY=$(echo | openssl s_client -servername "$host" -connect "$host:443" 2>/dev/null | \
    openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2)
  echo "$host: $EXPIRY"
done

# nuclei SSL/TLS misconfiguration scan
nuclei -l live_subdomains.txt -tags ssl,tls -json -o ssl_findings.json
```

### Risk Scoring

| Factor | Weight | Description |
|---|---|---|
| Internet exposure | 30% | Directly reachable from internet |
| Known vulnerabilities | 25% | CVEs found by scanning |
| Data sensitivity | 20% | Type of data accessible |
| Authentication | 15% | Auth mechanisms present |
| Patch currency | 10% | How current software versions are |

## Workflow

1. **Discover** — Enumerate subdomains, IPs, ports, and services
2. **Inventory** — Catalog all discovered assets with metadata
3. **Classify** — Tag assets as known, shadow IT, or decommissioned
4. **Scan** — Vulnerability scan all discovered assets
5. **Monitor** — Continuous alerting for new exposures and changes
6. **Reduce** — Decommission unused assets, remediate exposures

## Detection

```yaml
title: Attack Surface Management Detection
id: 610e6dae-6031-4e65-b371-76905a5e1d8b
status: experimental
description: Detects suspicious activity related to implementing attack surface management techniques in vulnerability management context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*implementing*attack*"
  condition: selection
level: medium
tags:
  - attack.t1595
  - attack.discovery
falsepositives:
  - Vulnerability scanner performing scheduled assessment scans
```

## Verification

| Check | Method |
|---|---|
| Subdomains complete | subfinder output covers all known domains |
| Live hosts identified | httpx confirms reachable endpoints |
| Ports scanned | naabu covers top 1000 ports minimum |
| Shadow IT flagged | Unknown assets identified vs inventory |
| Alerts configured | Shodan/nuclei monitoring active |

## References

- [ProjectDiscovery Documentation](https://docs.projectdiscovery.io/)
- [Shodan API Documentation](https://developer.shodan.io/api)
- [Certificate Transparency](https://certificate.transparency.dev/)
- [NIST SP 800-128 — Configuration Management](https://csrc.nist.gov/publications/detail/sp/800-128/final)
