Attack surfaceexposure library.

An Exposed Docker Engine API is a Docker daemon listening on TCP port 2375 (or 2376 without client-certificate verification) where anyone who can reach the port controls the daemon. Because the daemon runs as root and can mount the host filesystem into a container, an unauthenticated request is equivalent to root-level remote code execution on the host.

An exposed Jenkins instance is an internet-facing automation server whose web UI or CLI is reachable by anyone, often with anonymous or weak access that lets attackers reach the Groovy Script Console for remote code execution and harvest stored build credentials.

An exposed MongoDB database is a mongod instance reachable from the public internet (typically TCP 27017) with authentication disabled, so anyone who connects can read, modify, or delete every collection without credentials. It is one of the most reliably exploited data exposures on the internet and a frequent target of automated ransom-wipe campaigns.

An exposed Redis instance is a Redis key-value server reachable from untrusted networks (typically TCP 6379) without authentication, letting anyone who connects read and overwrite all data and, via CONFIG SET plus SAVE, write arbitrary files to achieve remote code execution.

Missing API rate limiting means a public endpoint accepts an unlimited number of requests from a single client without throttling, letting attackers run credential stuffing, data scraping, account enumeration, and resource-exhaustion denial-of-service at machine speed.

A publicly writable Firebase database is a Firebase Realtime Database or Cloud Firestore whose Security Rules permit unauthenticated read and write access, so anyone who learns the project ID can read, modify, or delete the entire dataset over a simple HTTPS request.

An unauthenticated API endpoint is an internal, admin, or data-handling route that responds to requests without verifying caller identity, letting anyone who finds the URL read or change data the API was never meant to expose publicly.

A publicly accessible cloud storage bucket is an S3, Google Cloud Storage, or Azure Blob container whose access controls let anyone on the internet list or download its objects without authentication, frequently exposing backups, logs, customer records, or secrets.

An exposed .env file is a dotenv configuration file (such as .env, .env.local, or .env.production) that a web server returns as plain text instead of keeping it private, handing attackers the database credentials, cloud access keys, and signing secrets your application loads at boot.

A subdomain takeover happens when a DNS CNAME or ALIAS record still points to a third-party service that has been deprovisioned, letting an attacker re-register that service name and serve their own content from your trusted subdomain.

An exposed admin panel is an administrative or login console reachable from the public internet without IP allow-listing, SSO, or a VPN in front of it, giving attackers a direct, internet-facing target for credential guessing and exploitation. Because these consoles grant privileged control of an application or device, exposing one converts a routine login into a remotely brute-forceable foothold.

A weak TLS configuration is an endpoint that still negotiates deprecated protocols (SSLv3, TLS 1.0/1.1), weak cipher suites, or omits HTTP Strict Transport Security, leaving encrypted traffic open to downgrade and man-in-the-middle interception. It is one of the most common findings on any internet-facing HTTPS surface.