Unit 01 of 03
Reconnaissance
The externally visible inventory of an authorized assessment: how many of the attack-surface candidates surfacing from public sources actually belong to the organization, which record in domain name and registration lookup proves ownership and which remains only a lead, the dangling item found by subdomain and asset discovery, the balance between the candidates port scan types find and the record they leave on the defense side, and how many candidates service fingerprinting can narrow down to a single version.
Published Updated
Lessons
- 01 Open-Source Intelligence From a publicly available item to an attack surface candidate: 29 items yielding 26 mentions and 20 unique candidates, 9 of which are evidence and 6 false positives (30%), the most accurate source producing 83% evidence and the least productive 0%, 12 of 45 validation steps returning zero evidence, the evidence count flattening after four sources while accuracy drops from 69% to 45%, and only 9 of a 13-item inventory being visible from outside. 14 min read
- 02 Domain Name and Registration Lookup Measuring a record's evidentiary strength: four record criteria's hit rates on 20 candidates ranging from 100% to 25%, the three strong criteria combined splitting off 10 candidates and capturing 8 evidence with zero false positives, the weak fourth criterion bringing 0 new evidence and dropping the hit rate from 80% to 62%, 60% of the 10 silent candidates being false positives while one is a real asset, and the cache path leaving 0 records while missing 1 evidence item and adding 2 false positives. 13 min read
- 03 Subdomain and Asset Discovery Counting dangling items in the name space: 7 of 24 zone records pointing to a target that no longer responds, three methods' coverage ranging from 66.7% to 29.2%, the method that leaves no trace finding the most candidates, the 120-attempt method producing 8.57 records per name found, linked-item inference finding none of the dangling items, the request that triggers 4 alerts bringing back 0 candidates, and the combination finding 21 records while never seeing 3 of them. 13 min read
- 04 Port Scanning Comparing scan types on the trace axis: in a 96-port space, 23 open ports being definitively distinguished by type between 78.3% and 0%, the one-way probe producing 21 ambiguous candidates and 3 false positives, the trace per piece of evidence ranging from 3.13 to 8.00 records, the same type slowed down producing the same 18 pieces of evidence with the same 72 records but 0 alerts instead of 2, and 91.3% coverage requiring a combination of two types. 13 min read
- 05 Service and Version Detection Measuring fingerprinting in terms of precision: at the first probe level, 13 of 21 services narrowing to a single version but 4 of them being assigned the wrong version, the evidence rate rising from 42.9% to 76.2% while the trace climbs from 42 records to 168 records and 6 alerts, the confirmed count dropping from 14 to 11 at the third level while accuracy is completed, and incorrect version information carrying 9 wrong lines into the finding list while missing 10 lines. 13 min read