VECTOR 05 // EXTERNAL RECONNAISSANCE

Attack Surface Management & Shadow APIs

Continuous asset discovery identifying unauthenticated staging routes, legacy endpoints, dangling DNS records, and shadow cloud assets mapped against your official API schemas.

DISCOVERY PIPELINE

4-Phase Attack Surface Mapping Process

PHASE 01

OSINT & DNS Crawl

Autonomous enumeration of global ASN allocations, Certificate Transparency logs, and historical subdomains.

PHASE 02

Route Reconciliation

Diffing discovered live endpoints against official Swagger/OpenAPI schemas to flag unauthenticated shadow routes.

PHASE 03

Takeover Probe

Testing for dangling CNAME records pointing to decommissioned S3 buckets, Elastic Beanstalk, and GitHub Pages.

PHASE 04

Continuous Triage

Delivering machine-readable inventory schemas and instant alerting hooks for newly discovered external ingress points.

Target Discovery Domains

Shadow API Gateways: Forgotten staging and test routes (e.g. api-dev, v1-deprecated).
Dangling Cloud Records: Abandoned AWS Route53, Cloudflare, and Azure DNS entries.
Exposed Admin Consoles: Unauthenticated Kubernetes Dashboards, Kibana, Airflow, and Prometheus.
Source Code Leaks: Automated scanning of public GitHub/GitLab repositories for enterprise tokens.

Deliverables & Artifacts

Dynamic OpenAPI Surface Diff: Live schema showing official vs discovered rogue endpoints.
Subdomain Takeover Remediations: DNS cleanup scripts and CNAME orphan neutralization.
Machine-Readable JSON Feeds: Integrates directly into your SIEM and security data warehouse.
Executive External Exposure Brief: High-level perimeter score for Board and CISO.

TECHNICAL ARTIFACT SPECIFICATION

Shadow Route Decommissioning & WAF Gateway Ingress

ROUTER: RECONCILE UNREGISTERED SHADOW ROUTES GATEWAY POLICY

- # Route /api/v1/test_customer allowed without API gateway schema validation

# BhishmaSec Hardened Rule: Strict Schema Enforcement (Drop Undocumented Endpoints)

+ location /api/ { + validate_openapi_schema /etc/nginx/openapi.yaml; + default_action drop; # Non-catalogued shadow routes return 404 immediately + }