Read the attack surface map

Summary

The attack surface map shows what a company exposes on the internet and how each element connects to the others. In this lesson you read it on the meccanicaadda.it scan: you learn to recognise the layers, isolate a single asset and bring forgotten subdomains to light.

The map sits in the scan's Overview tab, below the metrics. In the centre is the Main Domain with the totals of subdomains, IP addresses, open ports and technologies. The graph links subdomains to IP addresses, then to ports and technologies: each layer helps you see where a service is exposed.

Chapters

Key points

• Layers: main domain, subdomains, IP addresses, ports and services, technologies. Follow the links to trace a subdomain back to its server, its open ports and the software it exposes.
• Legend colours (top right): green for Active Subdomain, red for Inactive Subdomain, blue for IP Address, amber for Port / Service, purple for Technology and for the Main Domain.
• Isolate an asset: in the bar above the map, search for an element (for example vpn) with Search domains, IPs, ports, technologies... and select it. The map centres on the node and highlights only its connections. You can also click a node directly.
• Software and version shown on technology nodes help you pinpoint the vulnerabilities to fix.
• Asset Information: the button on domain and subdomain nodes opens the asset's details panel. Close the panel to get back to the map.
• Clear the selection: click the same node again or an empty area of the map.
• View controls: at the bottom right you find Zoom In, Zoom Out and Fit View, which shows the whole surface.
• Show Inactive (in the legend) reveals, in red, subdomains that no longer respond: they are often forgotten services to check or decommission. When there are many inactive subdomains, RECON hides them when the map opens to keep it readable.

Transcript

The full transcript of the video (in Italian) is available in the player's Transcript tab.

Related articles