Attack Surface

Monitor, explore, and manage the assets that make up your organization's external attack surface.

Attack Surface Management (ASM)

Attack Surface Management (ASM) continuously discovers and monitors all potential access points across your organization's digital footprint. Sprocket uses a combination of automated open-source intelligence and human-driven testing to identify assets associated with your organization based on the “seed objects” you provided, examples include apex domains, CIDR blocks and IP Addresses.

This data is used for External Pentesting in two ways. Proprietary automation will run against any assets marked as CPT Scope= CPT (true) and Ownership = Confirmed, automation includes tasks that gather data for reconnaissance to populate more details in the ASM and tasks that execute attacks against organization. Automated tasks are called Attack Narratives, read more details here.

Reviewing your Attack Surface

The Summary page provides a high-level view of your external attack surface and how it has changed over the last 30 days. To access the Summary, select Summary from the left navigation under Attack Surface. [1]

Each metric card displays the current count and 30-day change for a specific asset type. Clicking any card navigates to the corresponding asset view. The most important count to review is the New Assets. [2]

The Assets Over Time chart shows how your total asset count has changed over time, giving you visibility into growth or reduction in your attack surface.[3]

The Top 5 Origins for Asset Discovery chart shows the reconnaissance sources responsible for the most asset discoveries in your environment, reflecting the methods Sprocket uses to identify assets such as certificate transparency logs, DNS lookups, and brute force enumeration. [4]

Managing Assets

You can play a role in making sure the assets included in your ASM are accurate and authorized for testing.

CPT Scope

Assets marked as in scope are included in penetration testing. If a newly discovered asset should not be tested, you can exclude it from CPT scope.

To exclude an asset from CPT scope:

1. Select one or more assets using the checkboxes. [1]
2. Click the Actions dropdown. [2]
3. Select Exclude from CPT Scope. [3]

Ownership

Every asset in your attack surface has an Ownership Status that reflects Sprocket's confidence that the asset belongs to your organization. Ownership is determined by a confidence score, an automated metric calculated from discovery origin, business logic, and manual inputs from Sprocket testers or your team.

Ownership Values

You can filter any asset type view by Ownership Status using the Ownership filter. See Asset Types for asset-specific views.

Confirming or Disputing Ownership

From the asset list (bulk or individual)

1. Select one or more assets using the checkboxes. [1]
2. Click the Actions dropdown.[2]
3. Select Dispute Ownership. [3]

From the individual asset side panel

1. Click an asset to open the side panel.
2. Scroll to Ownership Status.
3. Under the Client Review section**,** click Confirm to confirm ownership or Dispute if ownership is inaccurate. [1]

Scope and Ownership History

Every change to an asset's ownership status or CPT scope is logged automatically. This audit trail is visible to all users on the Details tab of the asset slideout for Domains, DNS Records, IP Addresses, and Web Assets.

Each entry records:

• What the change was [2]
• Who made the change [3]
• When the change occurred [4]

This gives your team visibility into how your attack surface has been managed, helping you track decisions made across your organization and maintain an accurate scope over time.

Web Application Credentials

For assets identified as web applications, you can add credentials to allow your Sprocket testing team to conduct authenticated testing. This applies to organizations that have contracted with Sprocket for Web Application Testing. Assets included in this project are identified by a WebApp badge in the CPT Scope column of the Web Assets tab.

Credentials are stored securely and used only for authorized testing activities.

To add credentials to a web application asset:

1. Navigate to Web Assets in the Attack Surface section.
2. Click a Web Asset record that has the WebApp badge to open the slideout.
3. Select the Credentials tab, then click Add New. [1]
4. Enter the following information: [2]
   • Name of User Role: The role this credential represents, such as Admin or Read Only
   • Username: The username for the test account
   • Password: The password for the test account
   • Select Multi-Factor Authentication (MFA) type for this credential
     • No MFA or Authenticator App (TOTP)
       • If Authenticator App (TOTP), enter Authenticator Setup Key: The setup key or otpauth:// link from authenticator
   • Notes: Any additional context for your Sprocket testing team
5. Click Save.

Multi-Factor Authenticator (MFA): No MFA

Multi-Factor Authenticator (MFA): Authenticator App (TOTP)

You can add multiple credentials to a single asset to cover different user roles being tested. Credentials cannot be edited after saving, and passwords cannot be viewed after saving. If a credential needs to be corrected or rotated delete it and add a new one.

Sprocket automatically validates credentials on a recurring basis. The status of each credential and the last time it was checked are visible in the Credentials tab. [1]

If a credential is found to be invalid, you will receive an email notification identifying the specific credential that failed. Delete the invalid credential and add a new one to restore access for testing.

Custom Tags

Custom tags allow you to track groups of assets that are meaningful to your organization. You can filter by custom tag in asset views and the Findings page, and generate reports based on applied asset tags.

Custom tags can be applied to Domains, DNS Records, IP Addresses, Ports, Web Assets and URLs. They cannot be applied to Accounts.

Create a custom tag

To create a custom tag:

1. Click on the Tags button in the toolbar [1]
2. Select Add New Custom Tag from the dropdown menu. [2]
3. Enter the tag name, and click Create Tag [Modal]

Apply a custom tag

To apply a custom tag to an asset or assets:

1. Select the asset or assets using the checkboxes [1]
2. Click on the Tags button in the toolbar [2]
3. Select Tag Asset as (custom tag) that you want to apply [3]

Remove all custom tags

To remove all custom tags from an asset or assets:

1. Select the asset or assets using the checkboxes [1]
2. Click on the Tags button in the toolbar [2]
3. Select Remove Custom Tag from Asset [3]
4. Click Remove All Tags in the modal [4]

Manage custom tags

To remove unused or outdated custom asset tags:

1. Select the asset or assets using the checkboxes [1]
2. Click on the Tags button in the toolbar [2]
3. Select Manage Custom Tags [3]
4. Click the trashcan for delete on the tag(s) you want to remove [4]
5. Click Delete Tag in the modal to confirm

Changes

The Changes page tracks modifications to your attack surface over time. Sprocket detects and logs changes across all asset types to keep your inventory current.

Each change record includes:

• Detected Date: The date Sprocket detected the change
• Type: The asset type that experienced the change
• Description: A brief explanation of what changed
• Change Type: Whether the change was an addition, deletion, or modification

Changes can be filtered by time period, asset type, and change type.

Asset Types

Sprocket tracks the following asset types as part of your attack surface:

• Domains
• DNS Records
• IP Addresses
• Ports
• Web Assets
• URLs
• Accounts

To access Attack Surface, select Assets from the left navigation. By default, you will view the Domains tab. Depending on the Asset type, additional information about the asset can be accessed by clicking on the asset record to see the slideout.

Viewing Findings on an asset

When you open an asset, the Findings tab shows the open findings tied to that specific asset, so you can see what has been identified without leaving the asset. The number next to the tab is the count of open findings on that asset.

Each finding shows its Severity, a short description of the Finding, and its Status. To view the full details of a finding, select the arrow at the end of its row.

Domains

Domains are the apex-level entries that anchor your attack surface. Each domain tracked includes:

• Domain: The apex domain name
• Created: When the domain was added to ASM
• Unique DNS in CPT: Unique in-scope DNS records observed by ASM
• Unique DNS: Total unique DNS records observed by ASM
• DNS Records: Total DNS records associated with the domain
• Wildcard: Whether the apex domain arbitrarily responds to DNS record lookups
• Ownership: Sprocket's confidence that this domain belongs to your organization. See Ownership.
• CPT Scope: Whether the domain is included in penetration testing scope

DNS Records

DNS records provide detailed information about a domain's configuration and associated services. Each DNS record tracked includes:

• Record: The DNS record name
• Value: The data associated with the DNS record, such as an A, CNAME, or MX record value
• Record Type: The type of DNS record, such as A or CNAME
• Apex Domain: The domain associated with the DNS record
• Detected: The date the DNS record was first detected
• Last Seen: The date Sprocket last observed the DNS record
• Flux: Whether the DNS record frequently changes
• Ownership: Sprocket's confidence that this record belongs to your organization. See Ownership.
• CPT Scope: Whether the record is included in penetration testing scope

IP Addresses

IP Addresses represent the hosts Sprocket has discovered across your attack surface. Each IP address tracked includes:

• IP Address: The discovered IP address
• Reverse DNS: The hostname associated with the IP address via reverse DNS lookup
• ASN: The Autonomous System Number associated with the IP address
• DNS Records: Any DNS records pointing to this IP address
• Ports: Active ports detected on the IP address
• Detected: The date the IP address was first discovered
• Port Scan: Results of the most recent port scan
• Ownership: Sprocket's confidence that this IP address belongs to your organization. See Ownership.
• CPT Scope: Whether the IP address is included in penetration testing scope

Ports

Ports represent the network services detected on hosts within your attack surface. Each port tracked includes:

• Port: The network port on which the service is running
• IP Address: The IP address of the host running the service
• Protocol: Whether the service uses TCP or UDP
• State: The current state of the port, such as open, closed, or filtered
• Detected: The date the service was first discovered
• Last Seen: The most recent date the service was observed

Web Assets

Web Assets represent the web applications and pages discovered within your digital footprint. Assets identified as web applications by your Sprocket team will display a Web App badge in the CPT Scope column. Each web asset tracked includes:

• Image: A screenshot of the asset's landing page
• URL: The full web address of the asset
• Origin: The reconnaissance source used to discover the asset
• Detected: The date the asset was first discovered
• Last Seen: The most recent date the asset was observed
• Ownership: Sprocket's confidence that this asset belongs to your organization. See Ownership.
• CPT Scope: Whether the asset is included in penetration testing scope
• Tags: Any custom tags applied to the asset

URLs

URLs represent specific web pages or endpoints discovered within websites. Each URL tracked includes:

• URL: The full web address of the specific page or endpoint
• Response Code: The HTTP status code returned when accessing the URL
• Content Length: The size of the content returned by the URL
• First Seen: The date the URL was first discovered
• Last Seen: The most recent date the URL was observed
• Ownership: Sprocket's confidence that this URL belongs to your organization. See Ownership.
• CPT Scope: Whether the URL is included in penetration testing scope

Accounts

Accounts represent user accounts associated with your organizations and discovered through open-source intelligence techniques. Each account tracked includes:

• First Name: The first name associated with the account
• Last Name: The last name associated with the account
• Job Title: The job title associated with the account
• Email: The email address linked to the account
• Username: The username identified for the employee
• Phone: The phone number associated with the account
• Origin: The reconnaissance source used to discover the account

Integrations to Support a More Comprehensive Attack Surface

Cloud assets from Microsoft Azure and Amazon Web Services can be connected to automatically add cloud infrastructure to your external attack surface. Once connected, assets are pulled in automatically and monitored alongside your other attack surface data.

For setup instructions, see Integrations.