Application Attack Surface

Your Applications Are Your Biggest Exposure

Web applications and APIs are the front door to your business — and an entry point attackers target through stolen credentials and exploited vulnerabilities.

But it's not just the applications you know about. Each one — whether it's a customer-facing portal, an internal admin panel, a third-party integration, or a forgotten API endpoint — represents attack surface that needs to be discovered, tested, and monitored.

Guard treats your applications as a distinct attack surface, with purpose-built capabilities for discovering web applications, mapping their endpoints, testing for vulnerabilities, and validating that authentication actually works.

Why Applications Deserve Their Own Attack Surface

Testing once isn't enough

Applications keep changing after release, and new vulnerabilities keep being disclosed in the code and libraries they run. An application tested only before launch is untested from then on.

APIs are the new perimeter

As applications shift to API-first architectures — microservices, SPAs, mobile backends — the attack surface shifts with them. Traditional web scanners that crawl HTML don't test API authorization logic, and that's where the most dangerous vulnerabilities live.

Application sprawl creates blind spots

Teams deploy applications and services that security never hears about. Each untracked application is an untested application — and untested applications are where breaches happen.

Supply chain risk is inherited

Your applications inherit the vulnerabilities of every library and dependency they include.

What Guard Does About It

Guard addresses the application attack surface through a layered pipeline: discover applications, map their endpoints and content, test for vulnerabilities, and validate authentication and authorization.

Application Discovery

Before you can test an application, you need to find it. Guard automatically identifies web applications running on discovered HTTP/HTTPS services:

Vespasian uses seven discovery methods running concurrently: specification parsing (OpenAPI, WSDL), protocol introspection (GraphQL, gRPC), WebSocket detection, HTML crawling, and JavaScript analysis that extracts API calls from fetch(), axios, and XMLHttpRequest patterns in client-side code.

Content Discovery and Crawling

Once applications are identified, Guard maps their complete content:

Web crawling supports multiple modes: standard crawling, directory brute-forcing for hidden paths, login page discovery, and automatic combined crawling. Crawl sessions run for up to 9 hours to ensure comprehensive coverage of large applications.

Vulnerability Testing

With the application surface mapped, Guard tests for real security issues across multiple dimensions:

Dynamic Application Security Testing (DAST)

Enterprise DAST scanning provides deep application testing with automated crawling, session management, and vulnerability verification — the kind of testing that traditionally required a dedicated security engineer.

API Security Testing

API authorization testing covers 7 of the OWASP API Security Top 10 categories:

• Broken Object Level Authorization (BOLA) — Can User A access User B's resources? Tested across read, write, and delete operations
• Broken Authentication — Are endpoints properly enforcing authentication?
• Broken Object Property Level Authorization — Can users modify properties they shouldn't have access to?
• Broken Function Level Authorization — Can lower-privilege users access admin functions?
• Unrestricted Resource Consumption — Can APIs be abused for denial of service? (GraphQL)
• Security Misconfiguration — Are APIs exposing debug endpoints, verbose errors, or unnecessary methods?
• Improper Inventory Management — Are deprecated or undocumented API versions still accessible?

Testing uses a three-phase mutation pattern for stateful vulnerabilities: setup (create a resource as the victim), attack (attempt to access or modify it as the attacker), verify (confirm whether the attack succeeded). This proves vulnerabilities rather than just detecting potential issues.

Hadrian supports REST APIs (via OpenAPI/Swagger specs), GraphQL APIs (via introspection or SDL schemas), and gRPC APIs (via Protocol Buffer definitions), with 30+ built-in security test templates and support for custom templates.

SQL Injection Testing

Autonomous Source Code Analysis

Secret and Credential Detection

Credential Testing

Guard validates whether your application's authentication is actually stopping unauthorized access:

24 supported protocols for authentication testing, including HTTP/HTTPS Basic Auth alongside SSH, RDP, SMB, database protocols, and more.

Key features:

• Default credential detection per protocol
• Rate-limited execution to avoid account lockouts
• Manual-only execution — triggered only by security operators

The Application Assessment Pipeline

Port Scanning ─→ HTTP/HTTPS services found
  │
  ├─→ Web Application Discovery ─→ Valid applications identified
  │     │
  │     ├─→ Vespasian API Enumeration ─→ Endpoints mapped
  │     │     ├─→ OpenAPI/Swagger specs parsed
  │     │     ├─→ GraphQL schemas introspected
  │     │     ├─→ WebSocket endpoints detected
  │     │     └─→ JavaScript API calls extracted
  │     │
  │     ├─→ Web Crawling ─→ Pages and directories discovered
  │     │     ├─→ Login Detection ─→ Auth mechanisms identified
  │     │     ├─→ Screenshot Capture ─→ Visual evidence collected
  │     │     └─→ Webpage Secrets ─→ Exposed credentials found
  │     │
  │     ├─→ Enterprise DAST Scanning ─→ Runtime vulnerabilities detected
  │     │
  │     ├─→ Template-Based Scanning ─→ Known CVEs and misconfigs found
  │     │
  │     ├─→ Hadrian API Testing ─→ BOLA, BFLA, auth bypasses found
  │     │
  │     └─→ SQL Injection Testing ─→ Injection vulnerabilities confirmed
  │
  └─→ Constantine Source Code Analysis ─→ Vulnerabilities proven with exploits + patches

Each phase feeds the next. Discovered applications are crawled. Crawled pages are scanned for secrets and login forms. Login forms inform authentication testing. Endpoints feed into DAST and API security testing. The result is comprehensive coverage that goes from "what's running?" to "is it secure?" automatically.

What Users See in the Platform

Web Application Inventory

Every discovered web application appears as an asset with:

• Primary URL and associated URLs
• Technology stack detection
• Authentication mechanism identification (SSO provider, basic auth, etc.)
• Screenshot for visual verification
• Associated API specification (if discovered)

Vulnerability Findings

Application security findings include:

• OWASP category — Which Top 10 category the vulnerability falls under
• Severity and confidence — How critical it is and how certain the detection is
• Full evidence — Complete HTTP request/response pairs proving the vulnerability
• Endpoint context — Which specific URL, method, and parameters are affected
• Remediation guidance — What to fix and how

Scan Management

Application scans provide:

• Real-time status tracking for long-running DAST scans
• On-demand scan triggers for specific applications
• Historical scan results with trend tracking
• Configurable scan intensity (discovery-only vs. full vulnerability testing)

Capability Summary

Guard's application attack surface coverage spans the full assessment lifecycle:

All findings flow into Guard's unified risk management system — prioritized by severity, tracked through remediation, and correlated with your external, internal, and cloud attack surface findings for a complete security picture.