<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-attack-surface-analysis
description: >-
  Perform systematic attack surface analysis to enumerate entry points, exposed services,
  trust boundaries, and privilege levels across infrastructure, applications, and APIs
  to quantify and reduce organizational attack surface.
domain: cybersecurity
subdomain: security-architecture
tags:
  - attack-surface
  - exposure-management
  - entry-points
  - asset-discovery
  - risk-quantification
  - threat-enumeration
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1595"]
---

# Performing Attack Surface Analysis

## Overview

Attack surface analysis systematically identifies and quantifies all points where
an attacker could enter or extract data from a system. This skill covers external
and internal attack surface enumeration, scoring, and reduction strategies.

Mode: `[MODE: ARCHITECT]` — Attack surface assessment.

## Prerequisites

| Requirement | Details |
|---|---|
| Asset inventory and network diagrams | Required |
| `nmap` for network scanning | `apt install nmap` |
| `subfinder` for subdomain enumeration | Required |
| Cloud provider CLIs for resource inventory | Required |
| Python 3.10+ | Required |

## Key Concepts

### Attack Surface Categories

```
┌──────────────────────────────────────────────────────┐
│                  ATTACK SURFACE                       │
├──────────────┬──────────────┬─────────────────────────┤
│   Network    │  Application │     Human               │
├──────────────┼──────────────┼─────────────────────────┤
│ Open ports   │ API endpoints│ Phishing targets        │
│ VPN gateways │ Web forms    │ Privileged users        │
│ DNS records  │ File uploads │ Third-party access      │
│ Cloud IPs    │ Auth flows   │ Social media presence   │
│ IoT devices  │ GraphQL      │ Helpdesk processes      │
└──────────────┴──────────────┴─────────────────────────┘
```

### Attack Surface Score Formula

```
Attack Surface Score = Σ (entry_points × privilege_level × protocol_complexity × exposure)

Where:
  entry_points      = count of accessible interfaces
  privilege_level   = 1 (none) to 5 (admin)
  protocol_complexity = 1 (simple) to 3 (complex/stateful)
  exposure          = 1 (internal) to 3 (internet-facing)
```

### External Attack Surface Enumeration

```bash
# Subdomain discovery
subfinder -d example.com -all -o subdomains.txt

# Port scanning of discovered hosts
nmap -sV -sC -p- --min-rate 1000 -oA scan-results -iL subdomains.txt

# Certificate transparency log search
curl -s "https://crt.sh/?q=%25.example.com&output=json" | \
  jq -r '.[].name_value' | sort -u

# Cloud asset discovery (AWS)
aws ec2 describe-instances --query \
  'Reservations[].Instances[].{ID:InstanceId,IP:PublicIpAddress,State:State.Name}' \
  --output table

# Exposed S3 buckets
aws s3api list-buckets --query 'Buckets[].Name' --output text | \
  xargs -I{} aws s3api get-bucket-acl --bucket {} 2>/dev/null

# Exposed security groups
aws ec2 describe-security-groups --filters \
  "Name=ip-permission.cidr,Values=0.0.0.0/0" \
  --query 'SecurityGroups[].{Name:GroupName,Ports:IpPermissions[].FromPort}'
```

### API Attack Surface

```bash
# Enumerate API endpoints from OpenAPI spec
python3 -c "
import yaml, json
with open('openapi.yaml') as f:
    spec = yaml.safe_load(f)
for path, methods in spec.get('paths', {}).items():
    for method in methods:
        if method != 'parameters':
            auth = 'AUTH' if methods[method].get('security') else 'OPEN'
            print(f'{method.upper():6s} {path:40s} [{auth}]')
"
```

## Workflow

### Step 1: Asset Discovery

```bash
node scripts/agent.js --action discover --domain example.com
```

### Step 2: Enumerate Entry Points

```bash
node scripts/agent.js --action enumerate --targets targets.txt
```

### Step 3: Score Attack Surface

```bash
node scripts/agent.js --action score --inventory inventory.json
```

### Step 4: Generate Reduction Plan

```bash
node scripts/agent.js --action reduce --inventory inventory.json --output plan.json
```

## Detection

```yaml
title: Attack Surface Analysis Detection
id: 8801c998-c67c-4ca5-bccf-0aeb3b617719
status: experimental
description: Detects suspicious activity related to performing attack surface analysis techniques in security architecture context
logsource:
  category: network_connection
  product: firewall
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1595
  - attack.lateral_movement
falsepositives:
  - Network segmentation testing by authorized infrastructure teams
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Attack Surface Analysis Detection | firewall/network_connection | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1595 |

## Verification

- [ ] All internet-facing assets discovered and inventoried
- [ ] Open ports and services cataloged with version information
- [ ] API endpoints enumerated with authentication status
- [ ] Attack surface score calculated and baselined
- [ ] Unnecessary services disabled or restricted
- [ ] Reduction plan prioritized by risk score
- [ ] Monthly rescan scheduled for drift detection

## References

- [OWASP Attack Surface Analysis](https://owasp.org/www-community/controls/Attack_Surface_Analysis_Cheat_Sheet)
- [MITRE ATT&CK Initial Access](https://attack.mitre.org/tactics/TA0001/)
- [CIS Control 1 — Inventory of Enterprise Assets](https://www.cisecurity.org/controls)
