Back to Details

attack-surface-recon

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Attack Surface Recon

攻击面侦察

Build a complete external attack-surface picture from public sources.
基于公开资源构建完整的外部攻击面画像。

1. Root Domain Discovery

1. 根域名发现

  • Start from known brands/domains; expand via certificate transparency (crt.sh), ASN lookups, WHOIS reverse lookups, acquisition history
  • Identify cloud ranges: enumerate owned netblocks (bgp.he.net, ipinfo)
  • 从已知品牌/域名出发，通过证书透明度（crt.sh）、ASN查询、WHOIS反向查询、收购历史进行拓展
  • 识别云服务IP段：枚举所属网络块（bgp.he.net、ipinfo）

2. Subdomain Enumeration

2. 子域名枚举

  • Passive sources: CT logs, DNS datasets (SecurityTrails-style), web archives
  • Active: DNS bruteforce, permutation generation (alterations of known hosts: 
    -dev
    , 
    -staging
    , 
    -old
    )
  • Resolve; probe HTTP(S) for live services; fingerprint technologies (httpx/wappalyzer)
  • 被动来源：CT日志、DNS数据集（SecurityTrails 类型）、网页存档
  • 主动方式：DNS暴力破解、排列组合生成（对已知主机名进行变体：
    -dev
    、
    -staging
    、
    -old
    ）
  • 解析域名；探测HTTP(S)服务存活情况；识别技术栈指纹（httpx/wappalyzer）

3. Exposed Services

3. 暴露服务

  • Port scan in-scope IPs (top ports minimum, full range on high-value hosts)
  • Flag: exposed admin panels, databases (3306/5432/27017), RDP/SMB, Redis/Memcached, Kubernetes API, VPN portals, file shares
  • Takeover checks: dangling CNAMEs pointing at deprecated cloud services
  • 对范围内的IP进行端口扫描（至少扫描常用端口，高价值主机扫描全端口）
  • 标记风险项：暴露的管理面板、数据库（3306/5432/27017）、RDP/SMB、Redis/Memcached、Kubernetes API、VPN门户、文件共享
  • 接管风险检查：指向已弃用云服务的悬空CNAME记录

4. Credential and Code Leaks

4. 凭据与代码泄露

  • Breach data for corporate domains (report presence; never view more than proof)
  • Public code search (GitHub/gists) for org domains, tokens, internal hostnames in commits
  • Exposed storage: open S3 buckets/azure blobs matching org naming patterns
  • 排查涉及企业域名的泄露数据（仅报告存在情况，切勿查看超出举证所需的内容）
  • 在公开代码平台（GitHub/gists）中搜索提交记录里的企业域名、令牌、内部主机名
  • 暴露的存储服务：符合企业命名模式的公开S3存储桶 / Azure Blob存储

5. People and Brand

5. 人员与品牌

  • Employee enumeration via LinkedIn for phishing-simulation scoping (policy permitting)
  • Lookalike domains registered recently (typosquats), abuse of brand in app stores
  • 政策允许的前提下，通过LinkedIn枚举员工信息，用于划定钓鱼模拟的范围
  • 近期注册的仿冒域名（typosquats）、应用商店中的品牌滥用行为

Rules

规则

  • Passive sources preferred; active scanning only within authorization
  • Found leaked credentials: report immediately, do not log in with them
  • 优先使用被动来源；仅在授权范围内进行主动扫描
  • 发现泄露凭据：立即上报，切勿使用其登录系统

Output

输出

Ranked asset inventory: exposed services by risk, credential leak notifications, takeover-prone records, and monitoring recommendations.
按风险排序的资产清单：包含按风险分级的暴露服务、凭据泄露通知、易被接管的记录以及监控建议。