Module 1 · How attacks actually start Lesson 3 of 15
Attack surface: what you can see, you can defend
Every service listening on a port is something an attacker can talk to. Shrinking that list is the most effective defensive work there is, and it is less glamorous than it sounds.
The concept
Attack surface is everything an attacker can reach: open ports, web forms, old test pages, an admin panel, a Git repository with a key in it, an unattended laptop on a public network. You cannot defend what you have not listed, so the first exercise in any audit is making the list.
Do it on your own project this week. Which endpoints are public? Which database is reachable from the internet? Which repository has ever contained a password or a key? Which accounts have admin rights and do all of them need them? Every answer that surprises you is a finding, and finding them yourself is the job.
# Run only on your OWN machine.
ip=$(curl -s ifconfig.me)
nmap -F "$ip" # common ports
ss -tulpn # local listening services
systemctl list-units --type=service --state=running
Close what you do not need. Remove default accounts.
Enable a firewall. Fewer open doors, smaller attack surface.Common mistakes
The mistake is a development server left running with a default password, months after the project it belonged to. Remove, close or protect — and write down what you removed, because the list is what you show in an interview.
Worked example
A development server left running on port 8080 with no password is a breach waiting for a scanner. Scanners are automated and constant; nothing has to be targeted at you personally for this to be found.
Your practice task
List every service on your own machine that opens a port, and mark which ones you actually need.
Do this before moving on. Reading a solution teaches the shape of it; typing it teaches you.
Key takeaway
Attack surface is everything an attacker can reach: open ports, web forms, old test pages, an admin panel, a Git repository with a key in it, an unattended laptop on a public network.
Keep your place in this course
A free account saves which lessons you have finished and unlocks the certificate. The lesson itself stays free to read.
Create free account or sign inCourse complete
You finished every lesson.
Your certificate is ready, and the projects you built are the proof to attach to an application.
Almost there
15 lessons left of 15
Finish every lesson to unlock the certificate. Each one ends in a practice task — do them and the final project brief writes itself.