Attack surface identification
with Netlas.io

Netlas.io search engine supports searches through WHOIS records for both domains and IP addresses. The company name can be used as an initial piece of information. By utilizing the appropriate field in the query, it is possible to discover subnets managed by that specific company.

Numerous connections can be discovered by examining DNS records. You can search for domains connected to an IP or a specific subnet. It could involve the coincidence of MX records for domains or the mention of a specific IP address in a TXT record. You can search using any field of DNS registry to find related domains.

Netlas.io DNS database consists of billions of domains. It is growing every day. You can search for subdomains using the web-app and command line utility. There are also a number of third party applications integrated with Netlas.

Another important connection between entities on the Internet is cross-references. They can be found using a search within the body of responses. Contacts, such as emails, phones and tracking codes such as Google Tags or Facebook Pixel can be utilized. Meta data is also can be used. Sometimes search by SSL certificates can also reveal hidden pieces of the attack surface.

Since identifying the attack surface is a standard task we have developed the Attack Surface Discovery tool to address this challenge. This tool is highly intuitive and allows users to visualize attack surfaces in the form of a graph, which can include domains, IP addresses, networks, autonomous systems, WHOIS objects, and more.

Working with this tool is extremely straightforward; users do not need to input commands or apply filters; Netlas automatically performs searches for each graph object. Users only need to choose one of the possible ways to discover relationships, and the results will be instantly displayed as new nodes in the graph.