Attack Surface

Also Known As

TL;DR

Explanation

The attack surface of an application includes every endpoint, input field, API route, file upload, authentication mechanism, third-party dependency, and administrative interface that could be targeted. Reducing attack surface — disabling unused features, removing dead code, restricting API access, closing unused ports — is one of the most effective security improvements because it eliminates entire categories of risk rather than mitigating individual vulnerabilities. Regularly audit what is exposed and remove anything not actively needed.

Diagram

flowchart TD
    subgraph Attack Surface
        WEB[Web Endpoints<br/>/login /api /upload]
        AUTH[Auth Endpoints<br/>OAuth, password reset]
        FILE[File Handling<br/>uploads, includes]
        DEPS[Dependencies<br/>npm, composer packages]
        INFRA[Infrastructure<br/>SSH, admin panels, DB ports]
        THIRD[Third-party<br/>APIs, webhooks, embeds]
    end
    ATK[Attacker] --> WEB & AUTH & FILE & DEPS & INFRA & THIRD
    REDUCE[Reduce Surface:<br/>disable unused, patch, WAF] -.->|shrinks| WEB & AUTH & FILE
style ATK fill:#f85149,color:#fff
style REDUCE fill:#238636,color:#fff

Common Misconception

Why It Matters

Common Mistakes

• Leaving development endpoints (phpinfo, test scripts, debug routes) accessible in production.
• Unnecessary services running on production servers — each open port is an entry point.
• Overly permissive IAM roles or database users — principle of least privilege reduces blast radius.
• Not removing unused dependencies — each dependency is part of your attack surface.

Code Examples

// Attack surface expansion:
router()->get('/debug', fn() => phpinfo());          // Dev tool in production
router()->get('/test-email', fn() => sendTestEmail()); // Unauthenticated action
// MySQL user with GRANT ALL instead of SELECT, INSERT, UPDATE on app_db only
// Composer with 47 packages when 12 are actually used

// Attack surface = all points where untrusted input enters
// Reduce it: disable unused features, close unused ports

// Audit PHP attack surface:

// 1. Input vectors — every \$_GET/POST/COOKIE/FILES/SERVER access
$ grep -r '\$_GET\|\$_POST\|\$_COOKIE\|\$_FILES\|php://input' src/

// 2. Outbound — all external HTTP calls (SSRF risk)
$ grep -r 'file_get_contents\|curl_init\|GuzzleHttp' src/

// 3. Shell — command execution (RCE risk)
$ grep -r 'exec\|shell_exec\|system\|proc_open\|popen' src/

// 4. File system — include/require with dynamic paths (LFI risk)
$ grep -r 'include\|require' src/ | grep '\\$'

// 5. Disable what you don't use in php.ini:
// disable_functions = exec,system,shell_exec,passthru
// allow_url_include = Off

References

• ↗ https://en.wikipedia.org/wiki/Attack_surface
• ↗ https://cheatsheetseries.owasp.org/cheatsheets/Attack_Surface_Analysis_Cheat_Sheet.html

Tags

Related Terms