Exposure verification
Confirms which weaknesses are reachable from outside: external asset discovery and targeted checks against deployed endpoints.
Sub-techniques
2
| ID | Name | Description |
|---|---|---|
V1062.001 | External asset discovery | Enumerate domains, subdomains and exposed services. |
V1062.002 | Targeted confirmation | Send a request that demonstrates the weakness on a test deployment. |
Craft it
- Discover assets on a schedule.
- Map findings to exposed assets.
- Confirm with targeted templates against non-production environments.
Reverse engineer it
Signs that a codebase already runs this technique, and where to read how it is configured.
- Scheduled scan workflows and nuclei templates.
Open-source packages
3
- OWASP Amass owasp-amass/amass
- Nuclei projectdiscovery/nuclei
- ZAP zaproxy/zaproxy