Attack Surface Assessment

Using a combination of manual security analysis and automated reconnaissance tools the site, network and / or systems will be checked for Internet end points. The discovery process uses Internet wide data sets and open source intelligence resources. Results from the automated tools are assessed and used to further expand the attack surface. An easy to follow attack surface report is then compiled to provide an overview of the findings in an understandable format.

Sample Resources used:

• HackerTarget.com IP Tools
• CommonCrawl Website Archive
• Certificate Transparency Logs
• Reverse Whois searches for related domains
• Shodan.io and other Internet Wide Scanners
• Pastebin and other resources used by threat groups
• Search Engines (Google Dorks)
• Twitter / Facebook / Github and other Social Media Platforms
• Metadata leaks in published resources
• Other custom resources and data sets as required

By offering a focused tactical assessment service, we have streamlined the process and eliminated scope creep. Not everyone needs an assessment that takes weeks and costs tens of thousands of dollars. By having a fixed length testing window, the aim is to get an actionable understanding of the organisations Internet facing attack surface.

Rest assured that our focus does not impact our availability to answer your questions before, during and after the assessment.

The report is compiled after analysis of the results from the automated and manual testing. Sections include an overall summary of the endpoints found, a detailed list of discovered assets including recommended remediation of any glaring security issues and an appendix that contains the raw results from the tools that were used during the assessment.

Get in contact with the form below and provide an outline of your requirements. Organisations with a large number of endpoints will inevitably have a wide ranging attack surface. Once we have an idea of the number of Internet facing endpoints we will develop a proposal. Ideal for the CISO looking to get an external review of the attack surface from an adversary's perspective.

Payment is via Credit Card (preferred) or international money transfer to our bank. Once we receive your initial booking we will provide a copy of the terms of the assessment and payment details. Following confirmation of payment, we are ready and will proceed with the assessment at your allotted time. Reports are available within 72 hours.