OSINT Attack Surface Assessment for Small Businesses
A practical checklist for assessing a small business's external attack surface using open-source intelligence techniques.
Small and medium-sized businesses (SMBs) rarely have dedicated security teams. Over time, as they adopt new SaaS tools, migrate servers, and hire external contractors, their digital footprint expands into an unmanaged, messy perimeter. OSINT techniques are the most effective way to assess this external attack surface before threat actors do.
Phase 1: Domain and Infrastructure Mapping
The assessment begins by mapping what the business actually owns. You must identify all domains, subdomains, and associated IP addresses.
- •Subdomain Enumeration: Use tools like Sublist3r, Amass, or query Certificate Transparency logs to find forgotten development servers or legacy marketing sites.
- •DNS Records Check: Analyze SPF, DKIM, and DMARC records. Missing or misconfigured email authentication allows attackers to easily spoof the company's domain in phishing attacks.
Phase 2: Identifying Exposed Services
Once the IPs and subdomains are mapped, investigators must determine what services are running and exposed to the public internet.
Using platforms like Shodan or conducting targeted port scans (with permission) reveals the reality of the perimeter. Finding an exposed RDP (Remote Desktop) port, an unauthenticated database, or an outdated VPN gateway represents an immediate, critical risk that must be closed.
Phase 3: Credential and Breach Exposure
SMBs frequently suffer from employee password reuse. An employee uses their corporate email to sign up for a fitness app, the app gets breached, and the password is leaked.
Querying corporate email addresses against breach databases (like Have I Been Pwned or DeHashed) highlights immediate risks. If employees are not using Multi-Factor Authentication (MFA), a leaked password from a third-party site grants an attacker direct access to the corporate network.
Phase 4: Document and Code Leakage
Employees often take the path of least resistance when sharing files. This leads to data leakage across the web.
- 1GitHub Repositories: Search for the company name or specific domain strings in GitHub to find developers accidentally committing API keys or hardcoded passwords.
- 2Public Cloud Storage: Check for open AWS S3 buckets or unprotected Google Drive links associated with the company.
- 3Google Dorking: Use filetype operators to find confidential PDFs or Excel sheets indexed by search engines on the main corporate site.
Phase 5: Social Engineering Surface
Finally, assess the human element. LinkedIn and company "About Us" pages provide attackers with an organizational chart. They highlight who handles finances (the target for invoice fraud) and who the new hires are (who are more susceptible to authority-based phishing). Highlighting this exposure helps tailor internal training.
Automated Surface Monitoring
Aletheia provides continuous attack surface monitoring, instantly alerting you if a new subdomain is provisioned, an employee email appears in a breach, or a misconfigured service is exposed to the internet.