Back to Details

implementing-attack-surface-management

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Implementing Attack Surface Management

实现攻击面管理

When to Use

适用场景

  • When building an external attack surface management (EASM) program from scratch
  • When performing authorized external reconnaissance for penetration testing engagements
  • When continuously monitoring organizational exposure across internet-facing assets
  • When scoring and prioritizing external attack surface risks for remediation
  • When integrating multiple discovery tools into an automated ASM pipeline
  • 从零开始构建外部攻击面管理（EASM）程序时
  • 为渗透测试执行授权的外部侦察时
  • 持续监控组织面向互联网资产的暴露情况时
  • 对外部攻击面风险进行评分并确定修复优先级时
  • 将多种发现工具集成到自动化ASM流程中时

Prerequisites

前置条件

  • Python 3.8+ with requests, shodan, censys libraries installed
  • Shodan API key (free tier provides 100 queries/month)
  • Censys API ID and Secret (free tier available)
  • ProjectDiscovery tools installed: subfinder, httpx, nuclei
  • Go 1.21+ for building ProjectDiscovery tools from source
  • Appropriate authorization for all external scanning activities
  • Target domains and IP ranges with written scope documentation
  • 安装了requests、shodan、censys库的Python 3.8及以上版本
  • Shodan API密钥（免费 tier每月提供100次查询）
  • Censys API ID和密钥（提供免费 tier）
  • 已安装ProjectDiscovery工具：subfinder、httpx、nuclei
  • 用于从源码构建ProjectDiscovery工具的Go 1.21及以上版本
  • 所有外部扫描活动的适当授权
  • 带有书面范围文档的目标域名和IP范围

Instructions

操作步骤

Phase 1: Subdomain Enumeration with Multiple Sources

阶段1：多源子域名枚举

Use subfinder for passive subdomain discovery leveraging dozens of data sources including certificate transparency logs, DNS datasets, and search engines.
bash
undefined
使用subfinder进行被动子域名发现，利用数十个数据源，包括证书透明度日志、DNS数据集和搜索引擎。
bash
undefined

Install ProjectDiscovery tools

Install ProjectDiscovery tools

go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

Basic subdomain enumeration

Basic subdomain enumeration

subfinder -d example.com -o subdomains.txt
subfinder -d example.com -o subdomains.txt

Verbose with all sources and recursive enumeration

Verbose with all sources and recursive enumeration

subfinder -d example.com -all -recursive -o subdomains_full.txt
subfinder -d example.com -all -recursive -o subdomains_full.txt

Multi-domain enumeration from file

Multi-domain enumeration from file

subfinder -dL domains.txt -o all_subdomains.txt
subfinder -dL domains.txt -o all_subdomains.txt

Using OWASP Amass for deeper enumeration

Using OWASP Amass for deeper enumeration

amass enum -d example.com -passive -o amass_subdomains.txt
amass enum -d example.com -passive -o amass_subdomains.txt

Merge and deduplicate results

Merge and deduplicate results

cat subdomains.txt amass_subdomains.txt | sort -u > combined_subdomains.txt
undefined
cat subdomains.txt amass_subdomains.txt | sort -u > combined_subdomains.txt
undefined

Phase 2: Live Host Discovery and Service Fingerprinting

阶段2：存活主机发现与服务指纹识别

Probe discovered subdomains to identify live hosts, technologies, and services.
bash
undefined
探测已发现的子域名，识别存活主机、技术栈和服务。
bash
undefined

HTTP probing with technology detection

HTTP probing with technology detection

cat combined_subdomains.txt | httpx -sc -cl -ct -title -tech-detect
-follow-redirects -json -o httpx_results.json
cat combined_subdomains.txt | httpx -sc -cl -ct -title -tech-detect
-follow-redirects -json -o httpx_results.json

Detailed service fingerprinting

Detailed service fingerprinting

cat combined_subdomains.txt | httpx -sc -cl -ct -title -tech-detect
-favicon -hash sha256 -jarm -cdn -cname
-follow-redirects -json -o httpx_detailed.json
undefined
cat combined_subdomains.txt | httpx -sc -cl -ct -title -tech-detect
-favicon -hash sha256 -jarm -cdn -cname
-follow-redirects -json -o httpx_detailed.json
undefined

Phase 3: Shodan Asset Discovery

阶段3：Shodan资产发现

Query Shodan for exposed services, open ports, and known vulnerabilities associated with discovered assets.
python
import shodan

api = shodan.Shodan("YOUR_SHODAN_API_KEY")
查询Shodan获取已发现资产相关的暴露服务、开放端口和已知漏洞。
python
import shodan

api = shodan.Shodan("YOUR_SHODAN_API_KEY")

Search by organization

Search by organization

results = api.search("org:"Example Corp"") for service in results["matches"]: print(f"{service['ip_str']}:{service['port']} - {service.get('product', 'unknown')}") if service.get("vulns"): for cve in service["vulns"]: print(f" CVE: {cve}")
results = api.search("org:"Example Corp"") for service in results["matches"]: print(f"{service['ip_str']}:{service['port']} - {service.get('product', 'unknown')}") if service.get("vulns"): for cve in service["vulns"]: print(f" CVE: {cve}")

Search by hostname

Search by hostname

results = api.search("hostname:example.com")
results = api.search("hostname:example.com")

Search by SSL certificate

Search by SSL certificate

results = api.search("ssl.cert.subject.cn:example.com")
results = api.search("ssl.cert.subject.cn:example.com")

Get host details with all services

Get host details with all services

host = api.host("93.184.216.34") print(f"IP: {host['ip_str']}") print(f"Ports: {host['ports']}") print(f"Vulns: {host.get('vulns', [])}")
undefined
host = api.host("93.184.216.34") print(f"IP: {host['ip_str']}") print(f"Ports: {host['ports']}") print(f"Vulns: {host.get('vulns', [])}")
undefined

Phase 4: Censys Asset Discovery

阶段4：Censys资产发现

Use Censys to discover internet-facing assets through certificate and host search.
python
from censys.search import CensysHosts, CensysCerts
使用Censys通过证书和主机搜索发现面向互联网的资产。
python
from censys.search import CensysHosts, CensysCerts

Host search

Host search

hosts = CensysHosts() query = hosts.search("services.tls.certificates.leaf.subject.common_name: example.com") for page in query: for host in page: print(f"IP: {host['ip']}") for service in host.get("services", []): print(f" Port: {service['port']} Protocol: {service['transport_protocol']}") print(f" Service: {service.get('service_name', 'unknown')}")
hosts = CensysHosts() query = hosts.search("services.tls.certificates.leaf.subject.common_name: example.com") for page in query: for host in page: print(f"IP: {host['ip']}") for service in host.get("services", []): print(f" Port: {service['port']} Protocol: {service['transport_protocol']}") print(f" Service: {service.get('service_name', 'unknown')}")

Certificate transparency search

Certificate transparency search

certs = CensysCerts() query = certs.search("parsed.names: example.com") for page in query: for cert in page: print(f"Fingerprint: {cert['fingerprint_sha256']}") print(f"Names: {cert.get('parsed', {}).get('names', [])}")
undefined
certs = CensysCerts() query = certs.search("parsed.names: example.com") for page in query: for cert in page: print(f"Fingerprint: {cert['fingerprint_sha256']}") print(f"Names: {cert.get('parsed', {}).get('names', [])}")
undefined

Phase 5: Vulnerability Scanning with Nuclei

阶段5：使用Nuclei进行漏洞扫描

Run targeted vulnerability scans against discovered assets using Nuclei templates.
bash
undefined
针对已发现的资产，使用Nuclei模板运行定向漏洞扫描。
bash
undefined

Update nuclei templates

Update nuclei templates

nuclei -ut
nuclei -ut

Scan with all templates

Scan with all templates

cat combined_subdomains.txt | httpx -silent | nuclei -o nuclei_results.txt
cat combined_subdomains.txt | httpx -silent | nuclei -o nuclei_results.txt

Scan with specific severity

Scan with specific severity

cat combined_subdomains.txt | httpx -silent |
nuclei -severity critical,high -o critical_findings.txt
cat combined_subdomains.txt | httpx -silent |
nuclei -severity critical,high -o critical_findings.txt

Scan with specific template categories

Scan with specific template categories

cat combined_subdomains.txt | httpx -silent |
nuclei -tags cve,misconfig,exposure -o categorized_findings.txt
cat combined_subdomains.txt | httpx -silent |
nuclei -tags cve,misconfig,exposure -o categorized_findings.txt

Scan for exposed panels and sensitive files

Scan for exposed panels and sensitive files

cat combined_subdomains.txt | httpx -silent |
nuclei -tags panel,exposure,config -o exposed_panels.txt
undefined
cat combined_subdomains.txt | httpx -silent |
nuclei -tags panel,exposure,config -o exposed_panels.txt
undefined

Phase 6: Exposure Scoring Algorithm

阶段6：暴露评分算法

Score each asset based on OWASP attack surface analysis principles, using a weighted formula derived from the Relative Attack Surface Quotient (RSQ) and damage-potential-to-effort ratio.
The scoring algorithm considers:
  1. Open ports and services - weighted by service risk (management ports score higher)
  2. Known vulnerabilities - weighted by CVSS score
  3. Technology age - outdated software increases score
  4. Exposure level - internet-facing vs. authenticated access
  5. Data sensitivity - based on service type and content indicators
python
undefined
基于OWASP攻击面分析原则，使用源自相对攻击面商数（RSQ）和损害潜力与投入比的加权公式，为每个资产评分。
评分算法考虑以下因素：
  1. 开放端口与服务 - 按服务风险加权（管理端口评分更高）
  2. 已知漏洞 - 按CVSS评分加权
  3. 技术版本年限 - 过时软件会提高评分
  4. 暴露级别 - 面向互联网 vs 需认证访问
  5. 数据敏感度 - 基于服务类型和内容指标
python
undefined

Exposure Score = sum of weighted factors, normalized to 0-100

Exposure Score = sum of weighted factors, normalized to 0-100

See agent.py for the full implementation

See agent.py for the full implementation

undefined
undefined

Examples

示例

bash
undefined
bash
undefined

Run complete ASM pipeline against a target domain

Run complete ASM pipeline against a target domain

python agent.py
--domain example.com
--action full_scan
--shodan-key YOUR_KEY
--censys-id YOUR_ID
--censys-secret YOUR_SECRET
--output asm_report.json
python agent.py
--domain example.com
--action full_scan
--shodan-key YOUR_KEY
--censys-id YOUR_ID
--censys-secret YOUR_SECRET
--output asm_report.json

Subdomain enumeration only

Subdomain enumeration only

python agent.py
--domain example.com
--action enumerate
--output subdomains.json
python agent.py
--domain example.com
--action enumerate
--output subdomains.json

Exposure scoring on previously discovered assets

Exposure scoring on previously discovered assets

python agent.py
--domain example.com
--action score
--input previous_scan.json
--output scored_assets.json
python agent.py
--domain example.com
--action score
--input previous_scan.json
--output scored_assets.json

Multi-domain scan from file

Multi-domain scan from file

python agent.py
--domain-list targets.txt
--action full_scan
--output multi_domain_report.json
undefined
python agent.py
--domain-list targets.txt
--action full_scan
--output multi_domain_report.json
undefined