Evaluris

Scenario

External Attack Surface

Every forgotten subdomain is a door.

Continuously discover and assess what attackers see from the internet. Subdomains, open ports, services, SSL issues, and exposed surfaces - with verified findings and no agents on your network.

Outcomes

What you get

Continuous discovery of subdomains, DNS records, and internet-facing IPs
Port and service fingerprinting with version detection
SSL/TLS configuration and certificate validity checks
Identification of exposed panels, APIs, and known-vulnerability surfaces
Change detection and drift alerts when your perimeter shifts
CISO-ready reports with risk-scored findings and MITRE ATT&CK mapping
No agents or on-prem deployment - runs from SPECTER cloud

Scope

What we assess

Subdomains and DNS (A, AAAA, CNAME, MX, TXT)
Open ports and service banners (HTTP, HTTPS, SSH, RDP, DB, etc.)
TLS versions, ciphers, and certificate chains
Web technologies and headers (servers, frameworks, security headers)
Known CVEs and misconfigurations on identified stack
Attack path potential from external entry to internal assets

Attack path

External perimeter chain

Internet-facing discovery becomes a verified path into privileged systems.

  1. Internet

    attacker view

  2. Subdomain

    CI host exposed

  3. TeamCity

    CVE auth bypass

  4. Pipeline secrets

    token harvest

  5. AD foothold

    lateral ready

Demonstration

Live mission output

Multi-step chains with real CVE correlation, MITRE ATT&CK / ATLAS mapping, and verified proof-of-concept evidence - as SPECTER surfaces them in a mission.

SPECTER: external attack surface
_

Demo output (English)

Illustrative validated chains from staging engagements. CVE identifiers map to real-world threat intelligence (CISA KEV, vendor advisories). Destructive or high-impact steps (e.g. DCSync, LDAPNightmare exploitation) are shown as detected, operator-gated, or not executed where applicable.

Capabilities

Coverage at a glance

CapabilityIncluded
Asset discovery
Port & service scan
SSL/TLS assessment
CVE correlation
Attack path chaining
Agent required
Scheduled / continuous
Compliance-ready export

Scope this scenario in your environment with verified attack paths and compliance-ready evidence from day one.

Deploy Your First MissionSee full solution