What is attack surface mapping?

Attack surface mapping is making an inventory of everything an application exposes to an attacker: its pages, login boundaries, API endpoints, parameters, files and third-party services. It comes before testing, because every entry on the map is a place to test, and anything missing from it never gets tested.

Why it matters

NIST defines an attack surface as the set of points on a system's boundary where an attacker can try to enter, cause an effect or extract data. A web app's boundary is larger than its navigation menu: routes that only a signed-in user sees, endpoints the front end calls in the background, files left on the server, and old API versions nobody links to any more.

Mapping turns that boundary into a list you can work through. The OWASP Attack Surface Analysis Cheat Sheet recommends this order: identify the entry points, group them by risk and purpose, then focus on the remote ones, especially those open to anonymous, public access. It also makes a second pass cheap: after the next release you map again and test only what changed.

Example: what a first map of CyberGym turns up

On CyberGym, the legal practice target, a first pass with nothing but a browser and curl already finds entries that the shop's interface never shows. The robots.txt file, meant for search engines, names a directory, and that directory lists its own files:

$ curl -s https://cybergym.hackergpt.app/robots.txt
User-agent: *
Disallow: /ftp
$ curl -s https://cybergym.hackergpt.app/ftp/ | grep -o 'title="[^"]*"' | head -4
title="quarantine"
title="acquisitions.md"
title="announcement_encrypted.md"
title="coupons_2013.md.bak"

A Disallow line hides nothing from a person; it points at the directory. The listing then shows a .bak backup file, which a careful map records as its own entry to test. Add the API endpoints the front end calls, each with the authentication it requires, and the login boundary between the public shop and the account pages, and you have a map you can test against.

On your own site the method is the same, with one difference: you know what should be there, so every entry you did not expect is already a finding worth reading.

Common mistakes

  • Mapping only what the menu links to. Background API calls, signed-in routes and leftover files are where the surprises are. Crawl while logged in as well as logged out.
  • Treating the map as a vulnerability report. A map says where to look, not what is wrong. A clean-looking map is not a statement that the app is secure.
  • Mapping once. Every release adds routes and endpoints. Map again and compare.
  • Mapping a site you do not own. Even passive-looking crawling of someone else's app needs their written permission. Practise on CyberGym.

Related terms

Go deeper

Sources

Test only sites you own or have written permission to test. To practise without one, use CyberGym, a legal, deliberately vulnerable target. Practise on CyberGym.