External Attack Surface

What Is Your External Attack Surface?

Your external attack surface is everything an attacker can see from the outside — every domain, IP address, cloud resource, web application, and exposed service that faces the public internet. Most organizations dramatically underestimate its size. Shadow IT, forgotten subdomains, misconfigured cloud storage, and acquired company assets all expand it silently.

Guard continuously discovers, inventories, and tests your external attack surface so you can see what attackers see — before they exploit it.

Why Customers Add the External Attack Surface

You can't protect what you don't know about

Most security teams operate from a known asset list. But external reconnaissance reveals assets that never made it onto that list: dev servers left running, marketing microsites, acquired company domains, cloud resources spun up by engineering teams. Guard finds them automatically.

Attackers don't wait for your next audit

Point-in-time assessments go stale immediately. New subdomains appear, certificates expire, services get misconfigured. Guard runs continuously — scanning for changes and new risks as your infrastructure evolves.

The attack surface isn't just your domains

It extends into cloud provider consoles, code repositories, third-party SaaS integrations, and even SEC filings that reveal subsidiary relationships. Guard's discovery engine follows these connections to map your true perimeter.

What Guard Discovers and Tests

Guard's external scanning pipeline operates in phases, each building on the last. Assets discovered in one phase become targets for the next — creating a comprehensive, recursive map of your exposure.

Seed-Based Discovery

Everything starts with a seed — a domain, IP range, or cloud account you provide. From that seed, Guard's automated discovery engine expands outward:

Network Reconnaissance

Once assets are discovered, Guard maps the network-level exposure:

Nerva: Deep Service Fingerprinting

Nerva is Guard's purpose-built service fingerprinting engine. Unlike simple banner grabbing, Nerva sends protocol-specific probes to positively identify services and extract rich metadata — versions, configurations, and security-relevant details.

120+ supported protocols spanning:

• Databases — PostgreSQL, MySQL, MSSQL, Oracle, MongoDB, Redis, Cassandra, InfluxDB, Neo4j, Elasticsearch, CouchDB, and more

• Remote Access — SSH, RDP, Telnet, VNC

• Messaging & Queues — Kafka, MQTT, AMQP, ActiveMQ, NATS, Pulsar

• Industrial Control Systems — Modbus, S7comm, EtherNet/IP, PROFINET, BACnet, OPC UA, OMRON FINS, MELSEC-Q, KNXnet/IP, IEC 104, and more

• Telecom & VoIP — Diameter, SIP, H.323, SCCP/Skinny, GTP-C/U, PFCP

• VPN & Security — OpenVPN, WireGuard, IPsec/IKEv2, GlobalProtect, AnyConnect, FortiGate

• File & Directory Services — FTP, SMB, NFS, LDAP, Rsync

• Network Services (UDP) — DNS, DHCP, NTP, SNMP, NetBIOS, STUN, IPMI

• Developer Tools — Java RMI, JDWP, Docker, RTSP

Nerva supports TCP, UDP, and SCTP transports, outputs structured JSON with CPE identifiers, and integrates directly into Guard's discovery pipeline — every fingerprinted service feeds into CVE research and vulnerability scanning.

Web Application Discovery

HTTP/HTTPS services get deeper analysis:

Vulnerability Detection

With the attack surface mapped, Guard tests for real security issues:

Credential Testing (Brutus)

Guard includes Brutus, a purpose-built multi-protocol credential testing engine that validates whether discovered services are protected by strong authentication — or left wide open with default credentials.

24 supported protocols:

• Databases — MySQL, PostgreSQL, MSSQL, MongoDB, Redis, Neo4j, Cassandra, CouchDB, Elasticsearch, InfluxDB

• Remote Access — SSH (password + private key), RDP (with NLA/CredSSP), Telnet, VNC

• Enterprise Infrastructure — SMB, LDAP, WinRM, SNMP

• Web Services — HTTP/HTTPS Basic Auth

• Email — SMTP, IMAP, POP3

Key features:

• Embedded default credential lists per protocol — tests the credentials attackers try first

• Known-bad SSH key detection — identifies devices shipping with known private keys (Vagrant, F5 BIG-IP CVE-2012-1493, ExaGrid CVE-2016-1561, Barracuda CVE-2014-8428, and others)

• RDP Sticky Keys backdoor detection — identifies post-exploitation persistence (MITRE ATT&CK T1546.008) without requiring credentials

• Rate-limited execution — configurable requests-per-second to avoid lockouts

• Manual-only execution — Brutus runs only when explicitly triggered by a security operator, never automatically

Protocol-Specific Security Testing (Janus Framework)

Beyond web vulnerabilities, Guard tests 34 protocol-specific attack vectors via the Janus tool orchestration framework:

Database Exposure:

• MySQL, PostgreSQL, MSSQL, Oracle, MongoDB, CouchDB, Redis — default credential and authentication bypass testing

Network Service Risks:

• Anonymous FTP/FTPS access

• DNS zone transfers (AXFR)

• SNMP weak community strings

• LDAP null bind authentication bypass

• NFS share enumeration

• SMB user enumeration

• Open X11 servers

• Telnet with default credentials

Infrastructure Vulnerabilities:

• IPMI cipher zero exploitation and hash extraction

• Cisco Smart Install protocol abuse

• Unauthorized MQTT broker access

• IMAP NTLM information disclosure

• Java RMI/JMX/JDWP service exposure

Application Security:

• HTTP request smuggling detection

• Cookie security analysis

• CVE-specific scanners (e.g., SharePoint RCE)

• Mail security configuration checking (SPF/DKIM/DMARC)

Supply Chain & CI/CD:

• Dependency confusion scanning

• GitHub Actions artifact secret exposure (via Gato)

• Cloud storage bucket enumeration (S3, GCP, Azure via CloudBrute)

Secret & Credential Discovery

Cloud Infrastructure Assessment

For connected cloud accounts, Guard extends external scanning into cloud-native resources:

AWS: Public resource exposure assessment, secret discovery across AWS services (S3, RDS, EC2, Lambda, API Gateway)

Google Cloud Platform: Project enumeration, App Engine discovery, Compute Engine instances, Cloud Functions, Cloud Run services, Cloud SQL instances, Storage buckets, public networking exposure, and secrets scanning for each service type

Azure: Resource enumeration, public access assessment, secret discovery (connection strings, API keys), multi-tenant exposure detection

How It All Connects: The Discovery Chain

Guard doesn't run these capabilities in isolation. Each discovery feeds the next:

Seed (domain/IP/CIDR)
  │
  ├─→ Subdomain Enumeration ─→ New domains discovered
  │     └─→ DNS Resolution ─→ New IPs discovered
  │           └─→ Port Scanning ─→ Open services found
  │                 ├─→ Nerva Fingerprinting ─→ CPEs identified
  │                 │     └─→ CVE Research ─→ Known vulnerabilities matched
  │                 ├─→ Nuclei Scanning ─→ Vulnerabilities detected
  │                 ├─→ Brutus Credential Testing ─→ Weak auth found
  │                 └─→ Janus Templates ─→ Protocol-specific risks found
  │
  ├─→ TLS Certificate Mining ─→ Additional domains discovered
  ├─→ WHOIS / Reverse WHOIS ─→ Related domains discovered
  ├─→ CSP Mining ─→ Third-party dependencies mapped
  ├─→ Analytics Correlation ─→ Related properties linked
  └─→ SEC EDGAR Mining ─→ Subsidiary domains discovered

Each newly discovered asset re-enters the pipeline — subdomains get resolved, new IPs get port-scanned, new services get fingerprinted and tested. This recursive approach ensures complete coverage.

What Users See in the Platform

Seeds Management

Users start by adding seeds — domains, IP ranges, or web applications. The platform offers two modes:

• Discover assets only (passive): Maps the attack surface without active vulnerability scanning

• Discover and scan for risks (active): Full discovery plus vulnerability assessment

Asset Inventory

A paginated, filterable table showing every discovered asset with:

• Status (Active, Frozen, Pending, Deleted)

• Attack Surface classification (External, Internal, Dual)

• Network metadata (AS Name, AS Number, Country)

• Origin (which integration or seed discovered it)

• Vulnerability summary (Critical/High/Medium/Low/Info counts)

Asset Detail View

Drill into any asset for:

• Geographic visualization on a world map

• Technology stack detection

• WHOIS registration details

• Relationship graph showing connections to other assets

• Full attribute history

Risk Management

Every detected vulnerability includes:

• Severity rating (Critical through Info, plus Exposure)

• Lifecycle tracking (Triage → Open → Remediated/Accepted)

• ML-assisted triage predictions for prioritization

• Proof data from the scanning tool

• Remediation recommendations

Metrics Dashboard

Customizable widgets including:

• External Attack Surface Map: Geographic visualization of assets by country

• Asset Growth Over Time: Trend lines showing discovery rate

• Integration Origins: Breakdown of assets by discovery source

• Asset Counts: Domain, IP, and subdomain totals

Scan Management

Full visibility into scanning jobs with:

• Real-time status (Running, Queued, Pass, Fail)

• On-demand scan triggers per capability type

• Bulk operations for managing scan workloads

Data Model

Guard uses a unified data model linking assets, services, technologies, and vulnerabilities in a queryable graph:

Relationships between entities are stored as graph edges (HAS_PORT, HAS_VULNERABILITY, HAS_TECHNOLOGY, etc.), enabling complex queries like "find all external assets with critical vulnerabilities running Apache."

Integration Requirements

Most capabilities work out of the box. Some require credentials for enhanced functionality:

Scanning Intensity Levels

Guard supports configurable scanning intensity so customers can balance thoroughness with operational impact:

Assets can be individually frozen to pause scanning, or set to specific intensity levels based on sensitivity.

Summary

The External attack surface in Guard provides:

• 40+ native scanning capabilities for discovery, enumeration, and vulnerability detection

• Nerva service fingerprinting across 120+ protocols with CPE identification for precise vulnerability matching

• Brutus credential testing across 24 protocols with default credential detection and known-bad SSH key identification

• 34 protocol-specific tool chains via the Janus framework covering databases, network services, infrastructure, and CI/CD

• Multi-cloud assessment across AWS, Azure, and GCP

• Recursive discovery where every finding feeds back into the pipeline

• Configurable intensity from passive metadata collection to exhaustive security testing

• Unified data model linking assets → ports → technologies → vulnerabilities in a queryable graph

All capabilities are evidence-based — every finding traces back to a specific tool execution with proof data, ensuring actionable results rather than theoretical risk.