The most common external foothold is not a zero-day. It is a subdomain someone forgot about, a DNS record that still points to a decommissioned host, or a port that should never have been public. Attack surface mapping is the process of finding those before an attacker does.
Start with passive discovery
Passive discovery means collecting subdomains and hosts without sending a packet to the target. Useful sources include certificate transparency logs, passive DNS aggregators, public WHOIS history, search-engine indexes, and leaked code or configuration files. This is the safest way to build an initial inventory, and it often surfaces hosts that internal asset lists miss.
The catch is that passive data is stale by definition. A subdomain may have existed in a certificate log two years ago but now point to a parked page or an abandoned instance. You cannot tell if it is live from passive data alone.
Validate with active probing
Active probing resolves the names you found, checks which ones answer on HTTP or HTTPS, follows redirect chains, and inspects TLS certificates. This is where you learn whether that old subdomain is actually reachable and what service is running on it.
Port scanning adds another layer. A host might not answer on 80 or 443 but might expose an admin panel, database, or remote-access service on a high port. TCP service probes and banner grabs turn an open port into something you can reason about.
Why you need both
Passive-only mapping gives you a long list with no ground truth. Active-only mapping gives you ground truth for the names you already know, but it will miss assets that were never indexed by your seed list. The useful workflow is: passive to expand the candidate set, active to confirm what is reachable, then continuous rescanning to catch drift.
The drift problem
Attack surfaces rot quickly. A developer spins up a staging service, points a wildcard subdomain at it, and forgets to tear it down. A CDN misconfiguration exposes an origin directly. A marketing campaign creates a landing page with a separate DNS entry that outlives the campaign. Without periodic rescanning, you are working from a photograph, not a live map.
Build an inventory you can act on
A useful attack-surface inventory is not a spreadsheet of every DNS name you have ever seen. It is the set of live hosts, their open services, their technologies, and the evidence that proves they belong to you. Organize it by severity: exposed admin interfaces, outdated services, and wildcard endpoints should rise to the top. Everything else should be tagged and tracked so the next scan can tell you what changed.
The goal is not coverage for its own sake. It is to remove the obvious doors first, because that is what most attackers walk through.