It is good to define an attack surface before security testing.

Different places to attack:

  • Open pages & services (like login)
  • Attack to underlying layers/servers/etc
  • Attack to other users
  • ...

Different kind of attacks:

  • Owasp list attacks (XSS, injection, ...)
  • Burte force, DoS

Different risks...

So I was wondering what methods do you use? Attack surface analyzing is a part of for example Microsoft's The Security Development Lifecycle (SDL).

2 Answers 2


There is Microsoft's own Attack Surface Analyzer Tool which was first released in 2011, runs on Vista/Win7/Win Server 2008 and generates reports in HTML format.

Attack Surface Analyzer is all in one tool for analysis of changes made to the various parts of the attack surface of Windows 6 series Operating System (includes Windows Vista and Windows 7). Using this one tool, you can analyze the changes made to the Registry, File permissions, Windows IIS Server, GAC assemblies and a lot more can be done[7]. According to Microsoft, it is the same tool in use by the engineers of the security team at Microsoft to analyze the effects of software installation on the Windows Operating System.


Personally I think that the important first step of any security test is to build a good threat model. The threat modelling process if done correctly should surface a lot of the potential areas for attack.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.