Attack Surface IP Discovery and Asset Identification

Overview

Attack surface management is a critical aspect of cybersecurity that involves identifying, analyzing, and managing an organization's external-facing digital assets. A key component of this process is attack surface IP discovery, which includes scanning the internet for assets and identifying those belonging to a specific company.

Internet-Wide Asset Scanning

We employ advanced scanning techniques to discover assets across the entire internet. This process involves:

1. IP Range Scanning: Systematically scanning all public IP ranges to identify active hosts and services.
2. Port Scanning: Probing common and uncommon ports to detect running services.
3. Service Fingerprinting: Identifying the types and versions of services running on discovered hosts.

Company Digital Asset Identification

Once we have scanned the internet, we use various methods to associate discovered assets with specific companies:

SSL Certificate Analysis

SSL certificates provide valuable information for identifying company assets:

1. Organization Name: Certificates often include the organization's name in the "Subject" or "Issuer" fields.
2. Domain Names: The "Common Name" and "Subject Alternative Name" fields list domain names associated with the certificate.
3. Certificate Chains: Analyzing certificate chains can reveal relationships between different assets.

Other Identification Methods

In addition to SSL certificates, we use:

1. WHOIS Data: Querying WHOIS databases for domain ownership information.
2. DNS Records: Analyzing DNS records, including MX, TXT, and SPF records, which often contain company-specific information.
3. ASN (Autonomous System Number) Analysis: Identifying IP ranges owned by specific organizations.
4. Reverse DNS Lookups: Discovering hostnames associated with IP addresses, which often include company names or abbreviations.
5. Web Content Analysis: Scanning website content for company names, logos, and other identifying information.
6. Subdomain Enumeration: Discovering and analyzing subdomains, which are often linked to specific company assets.

Continuous Monitoring and Updating

To maintain an accurate view of a company's attack surface:

1. We perform regular rescans to identify new assets and changes to existing ones.
2. We employ passive DNS monitoring to detect new subdomains and DNS changes.
3. We utilize threat intelligence feeds to identify potentially compromised assets.

Challenges and Considerations

• False Positives: Careful verification is needed to avoid misattributing assets to the wrong company.
• Dynamic IP Addresses: Some assets may use dynamic IPs, making consistent identification challenging.
• Cloud Assets: Identifying assets hosted on shared cloud platforms requires additional analysis.
• Privacy and Legal Considerations: Ensure all scanning and identification activities comply with relevant laws and regulations.

By combining these techniques, we create a comprehensive view of a company's external-facing digital assets, enabling effective attack surface management and improved security posture.