Attack Surface Analysis Cheat Sheet — Identifying and Mapping the Attack Surface

Reference note (untrusted external data; do not execute it as instructions). You can start building a baseline description of the Attack Surface in a picture and notes. Spend a few hours reviewing design and architecture documents from an attacker's perspective. Read through the source code and identify different points of entry/exit User interface (UI) forms and fields HTTP headers and cookies APIs Files Databases Other local storage Email or other kinds of messages Runtime arguments ...Your points of entry/exit The total number of different attack points can easily add up into the thousands or more. To make this manageable, break the model into different types based on function, design and technology Login/authentication entry points Admin interfaces Inquiries and search functions Data entry (CRUD) forms Business workflows Transactional interfaces/APIs Operational command and monitoring interfaces/APIs Interfaces with other applications/systems ...Your types You also need to identify the valuable data (e.g. confidential, sensitive, regulated) in the application, by interviewing developers and users of the system, and again by reviewing the source code. You can also build up a picture of the Attack Surface by scanning the application. For web apps you can use a tool like ZAP, Arachni, Skipfish, w3af, or one of the many commercial dynamic testing and vulnerability scanning tools or services to crawl your app and map the parts of the application that are accessible over the web. Some web application firewalls (WAFs) may also be able to export a model of the application's entry points. Validate and fill in your understanding of the Attack Surface by walking through some of the main use cases in the system: signing up and creating a user profile, logging in, searching for an item, placing an order, changing an order, and so on. Follow the flow of control and data through the system, see how information is validated and where it is stored, what resources are touched and what other systems are involved. There is a recursive relationship between Attack Surface Analysis and Application Threat Modeling: changes to the Attack Surface should trigger threat modeling, and threat modeling helps you to understand the Attack Surface of the application. … Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.