Attack Surface
debt(d7/e7/b7/t5)
Closest to 'only careful code review or runtime testing' (d7). Tools like owasp-zap and nikto can find some exposed endpoints, but comprehensive attack surface assessment requires manual audit of routes, dependencies, and services. Most exposure goes unnoticed until pen-testing or incident.
Closest to 'cross-cutting refactor across the codebase' (e7). The quick_fix says 'audit every public endpoint, form, file upload, and API' — that's a system-wide review touching routes, configs, dependencies, and IAM, not a localized patch.
Closest to 'strong gravitational pull' (b7). Attack surface applies across web/api/cli contexts and shapes architectural decisions about what to expose, what dependencies to pull in, and what services to run — every feature addition must consider its surface impact.
Closest to 'notable trap' (t5). The misconception field flags that developers commonly believe attack surface = public-facing endpoints only, missing internal APIs, admin panels, dependencies, and dev tooling. A documented gotcha most security-aware devs eventually learn.
Also Known As
TL;DR
Explanation
The attack surface of an application includes every endpoint, input field, API route, file upload, authentication mechanism, third-party dependency, and administrative interface that could be targeted. Reducing attack surface — disabling unused features, removing dead code, restricting API access, closing unused ports — is one of the most effective security improvements because it eliminates entire categories of risk rather than mitigating individual vulnerabilities. Regularly audit what is exposed and remove anything not actively needed.
Diagram
flowchart TD
subgraph Attack Surface
WEB[Web Endpoints<br/>/login /api /upload]
AUTH[Auth Endpoints<br/>OAuth, password reset]
FILE[File Handling<br/>uploads, includes]
DEPS[Dependencies<br/>npm, composer packages]
INFRA[Infrastructure<br/>SSH, admin panels, DB ports]
THIRD[Third-party<br/>APIs, webhooks, embeds]
end
ATK[Attacker] --> WEB & AUTH & FILE & DEPS & INFRA & THIRD
REDUCE[Reduce Surface:<br/>disable unused, patch, WAF] -.->|shrinks| WEB & AUTH & FILE
style ATK fill:#f85149,color:#fff
style REDUCE fill:#238636,color:#fff
Common Misconception
Why It Matters
Common Mistakes
- Leaving development endpoints (phpinfo, test scripts, debug routes) accessible in production.
- Unnecessary services running on production servers — each open port is an entry point.
- Overly permissive IAM roles or database users — principle of least privilege reduces blast radius.
- Not removing unused dependencies — each dependency is part of your attack surface.
Code Examples
// Attack surface expansion:
router()->get('/debug', fn() => phpinfo()); // Dev tool in production
router()->get('/test-email', fn() => sendTestEmail()); // Unauthenticated action
// MySQL user with GRANT ALL instead of SELECT, INSERT, UPDATE on app_db only
// Composer with 47 packages when 12 are actually used// Attack surface = all points where untrusted input enters
// Reduce it: disable unused features, close unused ports
// Audit PHP attack surface:
// 1. Input vectors — every $_GET/POST/COOKIE/FILES/SERVER access
$ grep -r '\$_GET\|\$_POST\|\$_COOKIE\|\$_FILES\|php://input' src/
// 2. Outbound — all external HTTP calls (SSRF risk)
$ grep -r 'file_get_contents\|curl_init\|GuzzleHttp' src/
// 3. Shell — command execution (RCE risk)
$ grep -r 'exec\|shell_exec\|system\|proc_open\|popen' src/
// 4. File system — include/require with dynamic paths (LFI risk)
$ grep -r 'include\|require' src/ | grep '\\$'
// 5. Disable what you don't use in php.ini:
// disable_functions = exec,system,shell_exec,passthru
// allow_url_include = Off