Attack Surface Mapping

You can only defend the entry points you know about, and the dangerous ones are the ones nobody remembers. The attack surface is every place untrusted data or access crosses into your trust zone.

Enumerate every ingress, not just the front door

1. Network-facing: every open port, public endpoint, API (including undocumented/legacy/internal-but-reachable), webhook receiver, and admin panel. Shadow endpoints from old features are prime targets.
2. Input channels: request params, headers, cookies, file uploads, query strings, deserialized payloads, message-queue consumers, and anything parsed (XML, CSV, image metadata, archives).
3. Identity & access: auth endpoints, password reset, OAuth callbacks, API keys, session handling, service accounts, and any "internal" trust relationship.
4. Supply chain: dependencies, base images, build pipeline, third-party scripts/SDKs loaded at runtime. Code you didn't write runs with your privileges.
5. Data egress and side channels: error messages, logs, timing, response sizes, and metadata that leak information.

The forgotten surfaces (where breaches actually start)

• Legacy/forgotten: deprecated endpoints still routable, old subdomains, test/staging exposed to the internet, debug endpoints left on.
• Indirect input: data from a "trusted" partner or internal service that is itself attacker-influenced (second-order injection).
• Reachable internals: a microservice that's "not public" but reachable from a compromised peer; SSRF turning an internal-only service into an exposed one.
• The build/deploy pipeline: CI tokens, package registries, and IaC are an attack surface with production privileges.

Adversarial validation

• Reconnaissance pass: what would an attacker enumerate with no credentials — exposed ports, subdomains, JS bundles revealing endpoints, error messages revealing stack/versions?
• Trust-zone hopping: pick a compromised component and ask what it can now reach that the internet can't. The internal surface is usually far larger and softer.
• Input that reaches a dangerous sink: trace each input to where it hits a query, command, file path, deserializer, or template. Reachable sink = real vulnerability, unreachable = noise.
• Version/fingerprint leakage: do responses, headers, or errors reveal exact software versions that map to known CVEs?

Non-obvious risks

• Attack surface grows with every integration, feature flag, and "temporary" endpoint — it only ratchets up unless actively pruned.
• The largest surface is often internal (east-west traffic) where teams assume trust and skip authentication.
• Deserialization, template engines, and file parsers are disproportionately dangerous sinks; any untrusted path to them is high priority.

Output structure

Deliver: the complete ingress inventory (network, input, identity, supply chain, egress), the forgotten/legacy surfaces explicitly checked, the untrusted-input-to-dangerous-sink traces that are actually reachable, the internal (post-breach) surface, and a prioritized reduction list (close, authenticate, or isolate each).