Web Endpoint Reconnaissance: A 10-Point Attack Surface Checklist

Oct 18, 2026 4 min read cybersecurity, Development

Every public web service has an external footprint that automated scanners index within minutes. Open-source reconnaissance platforms like WebCheck parse domain records, TLS configurations, HTTP headers, and exposed endpoints without sending intrusive traffic. Security audits often prioritize application logic while leaving basic external indicators visible to the entire internet.

# Run an automated OSINT reconnaissance scan container
docker run -d -p 3000:3000 --name webcheck mwakidenis/webcheck

# Inspect public headers for security policies and banner leaks
curl -sI https://example.com | grep -iE '^(server|x-powered-by|strict-transport|content-security)'

Every exposed header, stale DNS record, and unauthenticated administrative route provides reconnaissance data before an attacker sends a single active payload.

Checklist

Server Tokens and Banner Leaks: Web servers like Nginx and Apache broadcast version numbers and operating system packages by default. Attackers use these banners to map known CVEs directly to your environment. Set server_tokens off in your web configuration and strip X-Powered-By headers at your reverse proxy. Scanners should receive only a generic HTTP status code without infrastructure hints.
Content Security Policy: Modern web reconnaissance engines check for missing script execution boundaries. Without an explicit CSP, cross-site scripting bugs and injected third-party assets execute in client sessions without restriction. Define script-src directives with nonces or cryptographic hashes, eliminate unsafe-inline flags, and restrict frame-ancestors to prevent clickjacking on unauthorized external domains.
Strict-Transport-Security Enforcement: Transport downgrade attacks exploit unencrypted HTTP initial handshakes. An HSTS header configured with a one-year max-age, includeSubDomains, and preload flags instructs browsers to refuse plain HTTP connections before sending any request. Verify that your root domain and subdomains serve HSTS so scanners cannot probe plaintext fallbacks across your infrastructure.
Cross-Origin Resource Sharing Controls: Wildcard headers paired with credentials expose internal endpoints to arbitrary origins. Automated scanners query OPTIONS headers to detect misconfigured CORS rules that reflect incoming Origin request headers. Restrict allowed origins to an explicit, authenticated list and disable credential transmission on public endpoints to prevent unauthorized cross-origin data extraction.
DNS Zone Hygiene: Public DNS records frequently leak internal architecture. Orphaned CNAME records pointing to decommissioned cloud instances allow subdomain takeovers, while unneeded TXT records disclose internal email providers, verification hashes, and testing platforms. Audit DNS zones on a regular schedule and delete stale staging records before external monitors map them.
Mail Authentication Records: Mail authentication records provide reconnaissance data for attackers planning impersonation attacks. Missing SPF records or permissive flags allow spoofing, while the absence of a DMARC policy with a reject directive advertises weak domain governance. Enforce strict DMARC policies with alignment checks to prevent domain spoofing during targeted phishing campaigns.
Cookie Security Flags: Session identifiers missing Secure, HttpOnly, or SameSite flags leave authentication tokens vulnerable to network interception and client script theft. External security scanners flag these cookies on the initial response inspection. Set SameSite to Lax or Strict, enforce the Secure flag across all cookies, and use Host- prefixes to bind cookies to your exact domain.
Robots and Sitemap Exposure: Disallow entries inside robots.txt often act as a direct directory index for attackers. Disclosing administrative paths, staging directories, or internal documentation endpoints in robots.txt tells scanners exactly where untested surfaces live. Protect internal portals through authentication and network firewalls rather than crawl exclusion rules in public files.
TLS Ciphers and Protocols: Deprecated protocols such as TLS 1.0 and 1.1, alongside weak CBC ciphers, expose connections to interception and downgrade exploits. Modern reconnaissance engines run automated handshakes to score cipher security against current cryptographic standards. Disable legacy protocols, mandate TLS 1.3 as standard, and restrict TLS 1.2 to forward-secret cipher suites.
Administrative Endpoint Isolation: Publicly accessible administration panels, metrics paths like actuator endpoints, and open database management ports create easy attack vectors. Scanners sweep IP ranges for exposed administrative panels and default credentials. Drop external traffic to management paths at the edge and require an isolated VPN or bastion tunnel for operational access.

External reconnaissance tools give defensive teams the same visibility that external attackers exploit daily. Auditing your public footprint regularly removes version leaks and misconfigured headers before external scans flag them.