Know your attack surface

Hacker's handbook • 2 min read

Your attack surface is everything a stranger on the internet can reach: every domain, every server, every open port, every API. Attackers start by mapping it, because they can only attack what they can find. Most teams have never made the same map, and the gap between what you think is exposed and what really is exposed is where break-ins begin.

How attackers find your systems

None of this requires access to anything of yours. It's all public.

Certificate logs: every HTTPS certificate is recorded in public transparency logs. Issue one for staging.yourapp.com and that name is public within minutes.
DNS records: subdomains can be guessed from common names such as dev, admin, api, and old, or collected from historical DNS data.
Internet-wide scanning: the entire public address space is scanned continuously. A new server is usually probed soon after it comes online, often within minutes.
Your own pages: JavaScript bundles, robots.txt, and sitemaps often name API hosts and paths you didn't mean to advertise.

What tends to be forgotten

Staging and test sites: usually less protected than production, and often connected to real data.
Old versions: the previous site, still running on a subdomain nobody visits or updates.
Databases and caches: a database port open to the whole internet instead of only to your application.
Storage buckets: cloud storage set to public so one file could be shared, with everything else in it public too.
Internal tools: dashboards, monitoring, and admin panels that were "temporarily" given a public address.
Dangling DNS: a subdomain still pointing at a cloud service you cancelled. Someone else can claim that service and serve their content on your domain.

Make your own map

List what you have, then check it from the outside. A few commands go a long way:

dig +short staging.yourapp.com
curl -sI https://staging.yourapp.com
nmap -Pn yourapp.com

The first shows where a name points, the second shows what answers there, and the third shows which ports are open. Only run these against systems you own.

For each thing you find, write down three facts: what it is, who owns it, and whether it needs to be public at all.

Shrink it

Turn off what you don't use. The safest server is the one that no longer exists.
Close ports by default. For most websites only 80 and 443 need to be open to the world. Databases and admin ports should accept connections only from your own servers.
Put internal tools behind a login you control, such as a VPN or single sign-on, not just an obscure address.
Make storage private by default and share individual files with expiring links.
Clean up DNS when you shut a service down.

Keep the map current

An attack surface isn't something you measure once. Every deploy, new subdomain, and "temporary" exception changes it. Review the list whenever you launch something, and check it automatically in between, so a new exposure is noticed by you first.

Conclusion

Attackers map before they attack. Make the same map yourself, remove everything that doesn't need to be public, and keep watching for new entries. The less you expose, the less there is to defend.