Attack Surfaces and Attack Vectors

Attack Surface: Mapping What an Attacker Can Reach

The Total Set of Entry Points

The attack surface of a system is the sum of all points where an unauthorized user can attempt to enter, extract data, or trigger a vulnerability. It is not just the obvious front door — it is every interface, every credential, every service, every human interaction, and every physical access point that an attacker could exploit.

Understanding your attack surface is the prerequisite for all other security work. You cannot defend what you have not mapped.

The Four Dimensions of Attack Surface

1. Network Attack Surface

Every open port, every listening service, every network protocol that accepts external input. This is the most commonly measured dimension because it is the most automatable:

# Enumerate open ports on a host
nmap -sV -sC -O target.example.com

# Check for exposed services from outside
nmap -Pn -p 1-65535 --open target.example.com

But the network attack surface includes more than open ports. It includes:

VPN endpoints and remote access gateways
DNS records that reveal internal infrastructure
SSL/TLS certificates that enumerate subdomains
Cloud storage buckets with public access
API endpoints, including undocumented ones
Network protocols that accept input without authentication (e.g., SNMP, SMBv1)

2. Application Attack Surface

Every input field, every file upload, every API parameter, every URL path, every HTTP header that the application processes. The application attack surface is often much larger than the network attack surface because a single web application may expose hundreds of endpoints, each with multiple parameters.

# Enumerate application endpoints from JavaScript files
# Attackers extract API endpoints from client-side code
curl -s https://app.example.com/main.js | grep -oE '"(/api/[^"]+)"'

The application attack surface includes:

Authentication and session management endpoints
File upload and download functionality
Search, filter, and query parameters
Error messages that reveal internal state
Admin interfaces exposed to non-admin users
Third-party integrations and webhooks

3. Human Attack Surface

Every person who can be manipulated into granting access or revealing information. This is the attack surface that technical controls cannot fully address because it exploits human psychology rather than technical vulnerabilities.

Phishing targets: employees with access to sensitive systems
Social engineering: help desk staff who can reset passwords
Insider threats: disgruntled employees with legitimate access
Third-party contractors with network access
Physical tailgating into secure areas

4. Physical Attack Surface

Every physical access point where an attacker can interact with hardware:

Unlocked server rooms and network closets
USB ports that accept bootable media
Workstations left unlocked in public areas
Network jacks in conference rooms and lobbies
Improperly disposed hard drives and documents

Mapping Your Attack Surface

A systematic attack surface mapping process:

Asset inventory: List every host, service, application, and data store. You cannot map what you do not know exists.
External reconnaissance: Use tools like nmap, amass, subfinder, and shodan to discover what is visible from the internet. This is what the attacker sees.
Internal enumeration: Map the internal network — what can be reached once an attacker breaches the perimeter? Use tools like bloodhound for Active Directory environments.
Application mapping: Crawl the application to discover all endpoints, parameters, and functionality. Tools like gobuster, ffuf, and Burp Suite's crawler automate this.
Human and physical assessment: Review access control policies, conduct phishing simulations, and audit physical security controls.

The output is an attack surface map — a living document that shows every entry point and its current exposure level.

Attack Vectors: The Paths Exploiting the Surface

How Attackers Turn Entry Points into Breaches

An attack vector is the specific method or pathway an attacker uses to exploit a vulnerability in the attack surface. If the attack surface is the door, the attack vector is the lock pick, the stolen key, or the open window.

Understanding attack vectors is essential because it tells you which vulnerabilities to patch first and which controls to prioritize.

Common Attack Vectors by Category

Phishing and Social Engineering

The most common initial attack vector in real breaches. An attacker sends a crafted email that tricks the recipient into revealing credentials, downloading malware, or authorizing a transaction.

# Example: Analyzing a phishing email header
# Look for spoofed sender domains and suspicious Received: paths
Received: from mail.evil.com (unknown [198.51.100.1])
	by mx.example.com with ESMTP id abc123
	for <victim@example.com>;
	Mon, 1 Jan 2026 12:00:00 -0800
From: "CEO" <ceo@example.com>

The From: header says ceo@example.com but the email actually originated from mail.evil.com. SPF, DKIM, and DMARC are the technical controls that detect this spoofing.

Exploiting Known Vulnerabilities

An attacker scans for systems running software with known CVEs and exploits them using publicly available exploit code.

# Check if a service version has known vulnerabilities
# Example: Apache 2.4.49 has CVE-2021-41773 (path traversal)
curl -s http://target/cgi-bin/.%2e/.%2e/.%2e/.%2e/etc/passwd

This is why patching and vulnerability management are critical — the attack vector is automated and indiscriminate. Attackers do not need to target you specifically; they scan the entire internet for vulnerable versions.

Credential-Based Attacks

Password spraying: Trying one common password against many accounts (avoids lockout thresholds)
Credential stuffing: Using username/password pairs breached from other services
Pass-the-hash: Using a captured NTLM hash to authenticate without knowing the plaintext password
Kerberoasting: Requesting service tickets for service accounts and cracking them offline

# Example: Password spraying with hydra (authorized testing only)
hydra -L users.txt -P 'Summer2026!' -t 4 -f ssh://target.example.com

Supply Chain Compromise

An attacker compromises a trusted third-party component — a software library, a hardware firmware, a managed service provider — and uses that trust to reach the target. The SolarWinds breach is the canonical example: attackers compromised the software update mechanism and reached every organization that installed the update.

Web Application Attacks

SQL injection: Injecting malicious SQL through input fields
Cross-site scripting (XSS): Injecting JavaScript that executes in other users' browsers
Server-side request forgery (SSRF): Tricking the server into making requests to internal services
Deserialization attacks: Manipulating serialized objects to execute arbitrary code

Physical and Environmental

Tailgating: Following an authorized employee through a secure door
USB drops: Leaving infected USB drives in parking lots and lobbies
Shoulder surfing: Observing passwords and PINs in public spaces
Dumpster diving: Retrieving sensitive documents from trash

Mapping Vectors to Surfaces

The most useful analysis maps each attack vector to the specific part of the attack surface it exploits:

Attack Vector	Attack Surface Dimension	Entry Point
Phishing	Human	Email credential theft
SQL injection	Application	Input field on web form
Password spraying	Human/Identity	Login endpoint
Exploiting CVE	Network/Host	Open service on port 443
Tailgating	Physical	Secure building entrance
USB drop	Physical/Host	USB port on workstation
SSRF	Application	Server-side HTTP client
Credential stuffing	Human/Identity	Login endpoint

This mapping tells you exactly where to apply controls. If password spraying is a likely vector against your login endpoint, you implement MFA and rate limiting on that endpoint. If tailgating is a risk, you implement badge access and security awareness training.

Attack Surface Reduction

The most effective way to reduce risk is to shrink the attack surface — eliminate entry points rather than trying to defend all of them:

Disable unused services: Every running daemon is a potential entry point. If a service is not needed, stop it and remove it.
Remove standing access: Eliminate unused accounts, unused API keys, and unused firewall rules. Each one is an entry point.
Close unused ports: If a port is not needed, close it. Use host firewalls to block inbound traffic to ports that do not need to accept connections.
Segment the network: Isolate critical systems so that a breach in one segment does not provide access to all segments.
Remove unnecessary functionality: Every feature is code, and every line of code is a potential vulnerability. If a feature is not used, remove it.
Implement egress filtering: Most firewalls focus on inbound traffic. But attackers need to exfiltrate data and receive commands. Egress filtering limits what can leave the network.

The goal is not to eliminate the attack surface entirely — that is impossible for any useful system. The goal is to reduce it to the minimum necessary and to ensure that every remaining entry point is monitored and controlled.

Practice Problems

0 / 2 solved

Solution

This represents the network attack surface (specifically, a cloud storage service exposed to the internet). The most likely attack vector is direct exploitation — an attacker discovers the public bucket through automated scanning (tools like S3 scanner or bucket enumeration) and accesses the data without any authentication. No phishing or social engineering is needed; the data is simply exposed. The fix is to remove public access and implement proper access controls, but the broader lesson is that attack surface mapping must include cloud storage, not just traditional network services.

Solution

Attack vector: phishing with a malicious macro attachment. Attack surface dimensions: human (the employee was the target) and application (the macro execution). The foothold led to system-level access because the workstation had local admin rights — a least privilege violation. Attack surface reduction would have: (1) blocked macros via Group Policy, eliminating the application attack surface; (2) removed local admin rights, limiting the blast radius to user-level access; (3) implemented application whitelisting to prevent unauthorized executables. The initial phishing email might still have arrived, but the macro would not execute and the attacker would not gain admin-level persistence.

Flashcards

Question

What is an attack surface?

Click to reveal answer

Answer

The sum of all points where an unauthorized user can attempt to enter, extract data, or trigger a vulnerability. Includes network, application, human, and physical dimensions.

Question

What is an attack vector?

Click to reveal answer

Answer

The specific method or pathway an attacker uses to exploit a vulnerability in the attack surface. Examples: phishing, SQL injection, password spraying, exploiting known CVEs.

Question

What are the four dimensions of attack surface?

Click to reveal answer

Answer

Network (open ports, services), application (input fields, API endpoints), human (phishing targets, social engineering), physical (unlocked doors, USB ports).

Question

What is password spraying and why is it effective?

Click to reveal answer

Answer

Trying one common password against many accounts. Effective because it avoids account lockout thresholds that trigger after multiple failed attempts against a single account.

Question

What is egress filtering and why does it matter?

Click to reveal answer

Answer

Limiting which outbound network connections are allowed. Matters because attackers need outbound communication for command-and-control and data exfiltration, even if inbound traffic is well-filtered.

Question

What is the most effective way to reduce risk from the attack surface?

Click to reveal answer

Answer

Shrink the attack surface — eliminate entry points rather than trying to defend all of them. Disable unused services, remove standing access, close unused ports, segment the network.

Revision Notes

Key Takeaways

1. Attack surface is what the attacker can reach; attack vector is how they exploit it
2. The human attack surface is often the largest and hardest to control technically
3. Incomplete asset inventory is the root cause of most attack surface surprises
4. Egress filtering is critical because attackers need outbound communication for C2 and exfiltration
5. The most effective risk reduction is shrinking the attack surface, not adding more controls
6. Attack surface mapping must be continuous — new assets, services, and endpoints appear constantly

Interview Tips

• When asked about attack surface, give a concrete example of how you mapped and reduced it in a real environment
• Be prepared to discuss the human attack surface — interviewers often probe whether you think beyond technical controls
• Explain how you prioritize which attack vectors to address first based on exposure and value
• Discuss a time when an incomplete asset inventory led to a security gap — this is a common real-world scenario
• Connect attack surface reduction to business value: fewer entry points means fewer controls to monitor and maintain

Cheat Sheet