threatfound
All paths
Beginner · 5 modules

Attack Surface & Exposure

Find what you are already leaking — exposed secrets, open .env and .git, subdomain takeover, and the recon that surfaces them.

▸ the territory
5 / 5 live

A map, not a checklist, see exactly where you are and what comes next.

  1. Leaked secrets: API k…10m
  2. ✓Exposed .env files &…9m
  3. ✓Subdomain takeover10m
  4. ✓Certificate Transpare…8m
  5. ✓Continuous attack-sur…9m

Lessons

read · then do
01Leaked secrets: API keys in code & git historyHow API keys, tokens, and database credentials leak through code and git history, why deleting them doesn't help, and how to detect, rotate, and prevent exposure. 10 min read
02Exposed .env files & open .git directoriesTwo classic deployment mistakes — a `.env` served as plain text and a browsable `/.git/` directory — hand attackers your secrets and your entire source tree, so learn to detect them by parsing the response, not trusting the status code. 9 min read
03Subdomain takeoverA dangling DNS record pointing at a de-provisioned third-party resource lets an attacker claim that resource and serve their own content on your trusted subdomain. 10 min read
04Certificate Transparency for subdomain discoveryCertificate Transparency logs are public, append-only records of every TLS certificate a CA issues — a passive goldmine that reveals staging, internal, and forgotten subdomains the instant they get a cert. 8 min read
05Continuous attack-surface monitoringContinuous attack-surface monitoring discovers your internet-facing assets, diffs each scan against the last, and alerts only on proven exposures — the smoke detector that covers the gaps a point-in-time pentest leaves open. 9 min read
Start the first lesson