External attack surface management: from inventory to prioritisation
You continuously inventory your organisation’s internet-facing domains, servers and services, find needless exposure and get it closed in priority order.
Level 301 · 18 lessons · 18 practice labs
Lessons
Concept and scope
- What the external attack surface is and why it keeps changing: You learn how new projects, forgotten test servers and supplier services make an organisation’s outside-facing footprint grow.
- Setting scope: which domains and addresses belong to us?: Before auditing, you will confirm which assets the organisation owns from records and prepare a written scope list.
- Seed data: domains, IP blocks and ASN records: You will find the organisation’s registered IP blocks and ASN details and use them as the starting point of the inventory.
- Short task: build the scope and seed-data list of a fictional organisation
Finding assets
- Automating the subdomain inventory with subfinder and amass: You will collect subdomains from passive sources with subfinder and amass, remove duplicates and keep a tidy list.
- Dangling DNS records and the risk of subdomain takeover: You will find DNS records still pointing to closed services and remove them so nobody else can claim that name.
- Shadow IT: catching servers and services nobody registered: You will find systems running under the organisation’s name but missing from the inventory, identify their owners and register them.
- Reviewing how your organisation looks on Shodan and Censys: You will find your organisation’s open services and version details on internet search engines and see how it looks from outside.
- Short task: collect subdomains and flag dangling records
Verifying and mapping
- Validating live web services and headers with httpx: You will use httpx to find which collected names really run a web service and record headers, status codes and technology.
- Mapping internet-facing services with Nmap at a careful rate: You will map open services on in-scope addresses with Nmap without straining live systems and compare them with the expected list.
- Finding expiring certificates and weak TLS settings with testssl.sh: You will check external services’ certificate dates and encryption settings with testssl.sh and list what needs renewal.
- Exposed admin panels and test environments: You will recognise admin screens and test sites reachable from the internet and recommend moving them behind a VPN or allow list.
- Short task: verify live services and list exposed admin panels
Prioritisation and continuity
- Ranking findings by severity, reachability and business impact: You will set the order of fixes by how serious, how reachable and how business-critical each finding is.
- Monitoring surface changes: diffing against the last scan: You will set up a routine that compares weekly scans and automatically notices newly opened services and domains.
- A two-layer surface report for managers and technical teams: You will prepare one report with a short risk summary for managers and a step-by-step fix list for the technical team.
- Capstone: map a fictional organisation’s external surface and write a fix plan: You map every internet-facing asset of a fictional organisation, rank the risks and present a fix plan with named owners.
Practice labs
- Build the scope and seed list for a fictional company: Compile Yakamoz Telekom's domains, IP blocks and ASN data from the lab records into a scope table.
- Verify every asset in scope belongs to the company: Compare the seed list's addresses and domains with registration data and remove the two entries that do not belong to the company.
- Bring an acquired company's assets into scope: Find the domains and addresses of the company Turnalı Perakende just acquired, verify ownership and write the updated scope document.
- Flag dangling DNS records: Resolve the targets of the collected subdomains and list the records pointing at targets that no longer exist.
- Remove a record pointing at a deleted service and verify: Delete the record in Mercanköşk Otelcilik's zone pointing at a decommissioned hosting service and verify the takeover risk is gone.
- Write a process control that prevents dangling records: Find and remove three dangling records, trace how they arose and write the DNS check step to add to the service-retirement process.
- Find an unregistered server and inventory it: Find the server visible in the external scan but missing from the inventory, identify what it runs and add it with its owner.
- Handle an unregistered site launched by the marketing team: Find Ayçiçeği Gıda's unregistered campaign site, assess its patch level and risks and record the ownership decision.
- Reconcile the internet-scan-engine view with the inventory: Match the services attributed to the company in the lab's scan-engine dump with the inventory and report missing and stale entries.
- Validate live web services and their headers: Run the subdomain list through a liveness check and record status code, title and server for each responding site.
- Find an exposed admin panel and restrict access: Find Kuzeyyıldızı Kargo's internet-facing admin panel, restrict access to the management network and retry from outside.
- List internet-facing test environments and plan their closure: Find Göktaşı Yazılım's externally reachable test and staging environments, assess the data they hold and write the closure order.
- Find expired and soon-to-expire certificates: Collect certificate expiry dates for the external services and list those expiring within thirty days with their owners.
- Prioritise weak TLS settings on external services: Scan the five external lab services with a TLS audit tool and rank the old-protocol, weak-cipher and incomplete-chain findings.
- Fix a weak TLS setting and retest from outside: Disable old protocol support on Yelkovan Bankası's customer portal, add the missing intermediate certificate and prove it by repeating the external audit.
- Rank external surface findings by severity and business impact: Score twelve findings by reachability, severity and business impact and write the top five with reasons.
- Diff against the previous scan and report new exposure: Compare last month's and this month's external surface outputs and write the newly exposed and vanished services into a change report.
- Write a two-tier surface report for managers and engineers: Map Çamlıbel Su İdaresi's external surface and prepare a one-page executive summary plus a technical annex with a closure plan.
About this course
You continuously inventory your organisation’s internet-facing domains, servers and services, find needless exposure and get it closed in priority order.
What you will learn
- Concept and scope
- Finding assets
- Verifying and mapping
- Prioritisation and continuity
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.