Implementing Attack Surface Management

When to Use

• When building an external attack surface management (EASM) program from scratch
• When performing authorized external reconnaissance for penetration testing engagements
• When continuously monitoring organizational exposure across internet-facing assets
• When scoring and prioritizing external attack surface risks for remediation
• When integrating multiple discovery tools into an automated ASM pipeline

Prerequisites

• Python 3.8+ with requests, shodan, censys libraries installed
• Shodan API key (free tier provides 100 queries/month)
• Censys API ID and Secret (free tier available)
• ProjectDiscovery tools installed: subfinder, httpx, nuclei
• Go 1.21+ for building ProjectDiscovery tools from source
• Appropriate authorization for all external scanning activities
• Target domains and IP ranges with written scope documentation