Skip to content
Attack Surface Validation LabProject Nightwatch · Synthetic

Phase 02–03 · Discovery & surface analysis

Attack Surface

An inventory is only useful when it records who owns an asset and where its authentication boundary sits. All identifiers, hostnames (*.lab.invalid), and addresses below use reserved documentation ranges and are entirely synthetic and non-routable.

Trust-zone map

Illustrative and non-operational. Boundaries mark where authorization must be re-established, not network topology.

Zone 1

Internet-Facing

  • WEB-01

    Customer portal

    portal.lab.invalid

  • API-01

    Public API gateway

    api.lab.invalid

  • VPN-01

    Remote access gateway

    vpn.lab.invalid

↓ boundary: re-authorize on transition

Zone 2

Application

  • ADMIN-01

    Administrative console

    admin.lab.invalid

  • APP-02

    Reporting service

    reports.internal.lab.invalid

↓ boundary: re-authorize on transition

Zone 3

Identity

  • IAM-01

    Identity service

    id.lab.invalid

↓ boundary: re-authorize on transition

Zone 4

Internal

  • DB-01

    Internal data tier

    db01.internal.lab.invalid

  • SVC-03

    Batch integration worker

    svc03.internal.lab.invalid

Asset inventory

Eight synthetic assets tracked through the engagement. Exposure and authentication boundary drive validation priority.

Synthetic attack-surface inventory
IDAssetTypeExposureService categoryTechnology familyOwnerAuth boundaryLast review
WEB-01Customer portalportal.lab.invalid198.51.100.11Web applicationPublicCustomer self-serviceSPA + managed edge/CDNPlatform Engineering (synthetic)Session cookie + MFA on sensitive actions2026-03-04
API-01Public API gatewayapi.lab.invalid198.51.100.12API gatewayPublicPartner + client integrationManaged gateway + token authorizerAPI Platform (synthetic)Bearer token, per-tenant scope claims2026-03-04
IAM-01Identity serviceid.lab.invalid198.51.100.20Identity providerRestrictedAuthentication and role assignmentOIDC provider + role directoryIdentity Engineering (synthetic)Admin plane restricted to privileged group2026-02-27
VPN-01Remote access gatewayvpn.lab.invalid198.51.100.30Remote accessPublicEmployee remote connectivityTLS VPN appliance (lab image)Infrastructure (synthetic)MFA required; split-tunnel disabled2026-02-18
DB-01Internal data tierdb01.internal.lab.invalid10.20.30.10Database clusterInternalTenant data storageManaged relational cluster (lab)Data Platform (synthetic)Service accounts only; no direct human access2026-03-01
ADMIN-01Administrative consoleadmin.lab.invalid10.20.10.25Internal web consoleRestrictedTenant administrationServer-rendered admin app (lab)Platform Engineering (synthetic)Privileged role + network allow-list (partially enforced)2026-03-05
APP-02Reporting servicereports.internal.lab.invalid10.20.20.14Internal serviceInternalAnalytics and exportContainer workload (lab)Data Platform (synthetic)Service-to-service token2026-02-21
SVC-03Batch integration workersvc03.internal.lab.invalid10.20.40.9Service account workloadInternalScheduled integrationJob runner (lab)Integration Team (synthetic)Long-lived service credential2026-01-30

Risk notes by asset

Short analyst commentary carried forward into validation.

WEB-01 · Internet-Facing

Customer portal

Primary tenant-facing entry point; carries several moderate configuration findings.

API-01 · Internet-Facing

Public API gateway

Rate-limit control missing on a lab endpoint; verbose error surface.

IAM-01 · Identity

Identity service

Test roles carry broader permissions than their documented intent.

VPN-01 · Internet-Facing

Remote access gateway

Banner discloses build/version detail; session timeout longer than policy.

DB-01 · Internal

Internal data tier

Network path from application subnet is broader than the documented design.

ADMIN-01 · Application

Administrative console

Authorization is enforced in the UI layer more consistently than server-side.

APP-02 · Application

Reporting service

Generates exports containing synthetic tenant records.

SVC-03 · Internal

Batch integration worker

A stale synthetic service account remains enabled after project retirement.

Responsible testing