implementing-attack-surface-management

name	implementing-attack-surface-management
description	Implements external attack surface management (EASM) using Shodan, Censys, and ProjectDiscovery tools (subfinder, httpx, nuclei) for asset discovery, subdomain enumeration, service fingerprinting, and exposure scoring. Includes a weighted risk scoring algorithm based on OWASP attack surface analysis methodology and the Relative Attack Surface Quotient (RSQ). Use when building continuous ASM programs or performing external reconnaissance for security assessments.
domain	cybersecurity
tags	["attack-surface","reconnaissance","shodan","censys","subfinder","nuclei","asset-discovery"]
subdomain	offensive-security
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["ID.RA-01","GV.OV-02","DE.AE-07"]

Implementing Attack Surface Management

Overview

Cybersecurity skill for implementing attack surface management. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "implementing attack surface management"

• "When building an external attack surface management (EASM) program from scratch"

• "When performing authorized external reconnaissance for penetration testing engag"

• "When continuously monitoring organizational exposure across internet-facing asse"

• When building an external attack surface management (EASM) program from scratch

• When performing authorized external reconnaissance for penetration testing engagements

• When continuously monitoring organizational exposure across internet-facing assets

• When scoring and prioritizing external attack surface risks for remediation

• When integrating multiple discovery tools into an automated ASM pipeline

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Python 3.8+ with requests, shodan, censys libraries installed
• Shodan API key (free tier provides 100 queries/month)
• Censys API ID and Secret (free tier available)
• ProjectDiscovery tools installed: subfinder, httpx, nuclei
• Go 1.21+ for building ProjectDiscovery tools from source
• Appropriate authorization for all external scanning activities
• Target domains and IP ranges with written scope documentation

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs() -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}