external-attack-surface-review
Skill0 starsChanged 11 days agoMITView on GitHub
Map and review your organization's own internet-facing attack surface — domains and subdomains (certificate transparency, DNS), IP ranges and ASNs, exposed services and versions (Shodan/Censys data on your assets), cloud endpoints, dangling DNS, exposed admin panels and edge devices — and prioritize fixes. Use for external exposure assessments, after acquisitions, or when a new edge-device vulnerability is announced.
In this repository273 other files it gives its agents.
- ad-attack-path-analysisSkill
- adcs-security-reviewSkill
- ad-privileged-access-reviewSkill
- dcsync-detectionSkill
- gpo-security-reviewSkill
- kerberos-attack-detectionSkill
- agent-tool-permission-reviewSkill
- ai-incident-responseSkill
- llm-gateway-controlsSkill
- llm-security-evaluationSkill
- mcp-server-security-reviewSkill
- model-artifact-securitySkill
- prompt-injection-reviewSkill
- rag-security-reviewSkill
- api-abuse-detectionSkill
- api-authorization-testingSkill
- api-inventorySkill
- api-schema-securitySkill
- dast-baselineSkill
- sast-triageSkill
- sca-dependency-riskSkill
- secure-code-reviewSkill
- security-requirementsSkill
- threat-modelingSkill
- asset-criticality-tieringSkill
- asset-inventory-reconciliationSkill
- shadow-it-discoverySkill
- aws-credential-compromiseSkill
- aws-iam-reviewSkill
- aws-org-guardrailsSkill
- cloudtrail-investigationSkill
- guardduty-triageSkill
- s3-exposure-reviewSkill
- azure-activity-investigationSkill
- azure-rbac-reviewSkill
- conditional-access-reviewSkill
- entra-audit-investigationSkill
- entra-signin-investigationSkill
- backup-assuranceSkill
- critical-service-mappingSkill
- ransomware-recoverySkill
- recovery-exerciseSkill
- cloud-exposure-reviewSkill
- cloud-incident-responseSkill
- cloud-logging-baselineSkill
- cloud-posture-assessmentSkill
- audit-evidence-packageSkill
- continuous-control-monitoringSkill
- control-mappingSkill
- control-testing-samplingSkill
- container-incidentSkill
- dockerfile-hardeningSkill
- image-scanningSkill
- runtime-detection-falcoSkill
- db-audit-loggingSkill
- db-exfiltration-investigationSkill
- db-hardeningSkill
- db-privilege-reviewSkill
- data-classificationSkill
- data-discoverySkill
- The first 60 shown.
The file
Files
External Attack Surface Review
Scope: assets your organization owns or is authorized to assess. Confirm ownership before any active probing.
Discover
# Subdomains from certificate transparency
curl -s 'https://crt.sh/?q=%25.example.com&output=json' | jq -r '.[].name_value' | tr '[:upper:]' '[:lower:]' | sed 's/^\*\.//' | sort -u > ct.txt
# Passive subdomain enumeration (authorized use of APIs)
subfinder -d example.com -silent > subfinder.txt
cat ct.txt subfinder.txt | sort -u > subs.txt
# Resolve and find live web services
dnsx -l subs.txt -a -resp -silent > resolved.txt
httpx -l subs.txt -title -status-code -tech-detect -silent > web.txtIP space: RIR/WHOIS for your ASNs and allocations, cloud provider IP inventories (cloud-exposure-review). Passive service data: Shodan/Censys queries limited to your ranges/domains (net:203.0.113.0/24, ssl.cert.subject.cn:example.com).
Review
| Finding | Priority |
| Edge devices (VPN, firewalls, file transfer, remote access gateways) with vulnerable versions | P1 — frequent KEV entries |
| Admin interfaces exposed (RDP, SSH with passwords, management GUIs, Kubernetes API, database ports, Elasticsearch/Redis/MongoDB) | P1 |
| Dangling DNS (CNAME to deprovisioned cloud resources) | P1 — subdomain takeover |
| Staging/dev sites with real data or no auth | P2 |
| Expired/weak TLS, missing HSTS | P3 |
| Unknown assets (no owner) | Investigate: shadow IT or third party |
Dangling CNAME check: dig +short CNAME sub.example.com → target returns NXDOMAIN or a provider "no such bucket/app" page.
Safety
Active scanning (port scans, nuclei) only on assets confirmed as yours, with authorization, low rate, and coordination with the SOC and hosting providers.
Related skills
cloud-exposure-review, exposure-validation, shadow-it-discovery, emergency-vulnerability-response
References
- CISA Cyber Hygiene vulnerability scanning service: https://www.cisa.gov/cyber-hygiene-services
- ProjectDiscovery tools (subfinder, dnsx, httpx): https://docs.projectdiscovery.io/
- crt.sh: https://crt.sh/
- OWASP subdomain takeover guidance (WSTG): https://owasp.org/www-project-web-security-testing-guide/
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.