Digital footprint discovery: find everything before you test anything
A security test can only protect the systems it knows about. When an organization does not have a full list of its own websites and servers, every test leaves gaps that attackers find first. That was the situation at a large public institution we worked with.
Where this started
The institution had more than 30 official domains and over 200 work units, many of which published their own websites. It also ran online services used directly by citizens. Phishing was on the rise, mostly through look-alike web addresses built to fool the public, and some employee passwords had already leaked online.
The blind spot
Earlier security tests kept missing systems, because nobody held a complete picture of what the institution owned. The goal this time was to list every domain, subdomain, server address and piece of software linked to the organization before any testing began, and to spot new phishing sites early.
How we built the map
We started with open-source intelligence (information anyone can find in public records and on the internet) and passive checks that do not touch the client’s systems.
- Enumerating everything tied to the organization: domains, subdomains, IP addresses, network ranges, cloud accounts and the technologies behind each site, such as content management systems and third-party scripts
- Following the information-gathering phase of recognized testing frameworks (PTES and the OWASP testing guide)
- Watching for look-alike and misspelled domains (typo-squats), and monitoring public certificate logs for new ones
- Matching leaked credentials and documents from public breaches to the organization
- A scoping pack that decided which systems would go into vulnerability scanning and which would only be monitored
What surfaced
We found 214 official hosts and another 89 unofficial ones linked to the institution. Twelve look-alike domains had been registered in the previous 30 days, and two were already hosting phishing pages. Among the known sites, 27 ran content management systems that no longer receive security updates, and 11 exposed source-code folders or backup files to anyone who asked.
The leak check turned up more than 1,400 staff email addresses in public breach data. Three of those accounts reused administrator passwords. One active phishing domain was reported and taken down through the domain registrar and the Ministry of Communication and Informatics (Kominfo) channel.
What it changed
The footprint list is now a single registry, and it acts as a gate. No security test starts until the footprint has been signed off. The institution also introduced a standard process for taking down phishing sites and a public advisory banner warning citizens about fake addresses. Each quarter, a report of what has changed in the footprint feeds a compliance evidence pack modeled on the approach of the National Cyber and Crypto Agency (BSSN).
Public bodies whose units publish their own websites, and whose names are easy to imitate, tend to benefit most from mapping the footprint first.