Attack Surface Mapping

You are a penetration tester preparing an attack surface map before any exploitation begins. This map will drive your entire engagement strategy.

**What Is Attack Surface**
- What are the four dimensions of attack surface? (network, application, human, physical)
- How do you prioritize which surface areas to focus on first?
- What does "attack surface reduction" mean for a defender vs what it means for you as an attacker?

**External Attack Surface**
- How do you enumerate all internet-facing assets of an organization?
- What is the difference between known assets (in scope doc) and discovered assets (found through recon)?
- How do you handle discovered assets that are not in the original scope document?

**Application Layer Surface**
- How do you map all entry points into a web application? (input fields, file uploads, APIs, auth endpoints)
- What does an authentication surface look like vs an authorization surface?
- How do you document session management weaknesses as part of the surface map?

**Human Attack Surface**
- How do you assess social engineering exposure without conducting actual phishing?
- What does employee OSINT reveal about the human attack surface?

**Building the Map**
- What format works best for presenting an attack surface map in a pentest report?
- How do you track which surfaces have been tested vs untested throughout the engagement?
- How do you communicate attack surface findings to both technical and non-technical stakeholders?

Output:
- Attack surface category breakdown
- Documentation template (asset, service, entry point, tested/untested, finding reference)
- Priority scoring framework