Mapping public-facing infrastructure without overstepping

You cannot assess what you have not inventoried

Most organisations know their primary domain and their website. Fewer can list every subdomain, every public IP address and every service listening on them. That inventory is the foundation of any external assessment, and it is usually the first output of one.

Start with what is authoritative: the DNS zone file from your DNS provider, the public IP ranges from your hosting provider, and the certificate transparency logs for your domain, which reveal hostnames that were issued certificates even if you have forgotten them.

Passive sources worth knowing

Certificate transparency logs are public by design: every publicly trusted certificate is recorded, so searching them for your domain surfaces historical hostnames. Search engine indexes reveal pages that were meant to be unlisted. Job postings reveal technology stacks. None of this requires touching the organisation's infrastructure.

Passive sources are also useful for the reverse case: understanding what an attacker could learn about you without any active probing at all.

Where authorisation stops being optional

Passive research is generally benign. Active probing is not: connecting to a host, requesting a URL or completing a protocol handshake is traffic to a system someone else may own.

If the infrastructure is yours, you are the authorisation. If it belongs to a client, get it in writing, scoped to specific hosts and a specific window. If it belongs to your hosting provider, their acceptable-use policy applies on top of your own permission.

SMB Scanner Lite's public edition avoids the question entirely by restricting itself to five reserved test domains. There is no legitimate reason for a public demo to connect to arbitrary hosts.

Shadow infrastructure is the hard part

A marketing landing page stood up by an agency, a staging environment with a default password, an old intranet still resolving — these are the systems that never appear in the inventory because nobody considered them part of it.

External assessment is particularly good at surfacing them, because it observes what is reachable rather than what is documented. That is also why findings occasionally produce the response "we did not know that existed", which is the most valuable result an assessment can deliver.

Scoping an assessment defensibly

Write down the domains and IP ranges in scope, the exclusions, the time window, the vantage points and the contact who can authorise stopping. Include what will happen if something in scope turns out to belong to a third party.

For a small business that inventory may be five lines long. The discipline still matters: it is the difference between an assessment and unauthorised scanning.

Where to go next

The methodology describes how SMB Scanner Lite turns observations into findings. The capability catalog lists which controls address exposed services, and the responsible use page covers authorisation in more detail.