enumeraite: AI Assisted Web Attack Surface Enumeration

enumeraite: AI Assisted Web Attack Surface Enumeration

Speakers: Özgün Kültekin, Offensive Security Engineer, Trendial Group

Conference: Recon Village

YouTube: https://www.youtube.com/watch?v=IzsBS_E2RVY

Overview

In the rapidly evolving landscape of web security, effectively mapping an organization's attack surface remains a formidable challenge. Özgün Kültekin, an Offensive Security Engineer at Trendial Group, presented his latest research on enumeraite, an AI-assisted web attack surface enumeration tool, at Recon Village. This talk addresses the critical problem of shadow IT and the exponential growth of web assets, which often leaves organizations vulnerable to undiscovered attack vectors. Kültekin’s work highlights how traditional reconnaissance methods are increasingly insufficient and proposes a novel approach leveraging Large Language Models (LLMs) to intelligently discover hidden subdomains and API endpoints.

The core of Kültekin's research is to redefine reconnaissance by integrating contextual understanding and predictive capabilities of AI. Instead of brute-forcing with static wordlists or relying on passive information, enumeraite uses AI to learn target-specific naming conventions and generate highly probable, yet previously unseen, attack surface elements. This approach aims to empower both offensive security professionals in their penetration tests and bug bounty hunts, as well as defensive teams striving to protect what they often don't even know exists.

Background

▶ Watch: Introducing AI-assisted web attack surface enumeration tool (0:00)

The modern enterprise web attack surface is a sprawling, complex entity. Kültekin illustrates this with the example of Netflix's architecture from nine years ago, which was already a tangled web of interconnected services, emphasizing how much more complex it must be today. This complexity leads to what he terms "enumeration hell," where discovering all functionalities of a target web application becomes an overwhelming task. Challenges include Cloudflare and rate-limiting hindering brute-force attempts, the proliferation of multiple frameworks, leftover third-party libraries, hidden parameters, and the sheer difficulty of prioritizing discovery efforts.

A significant problem is the existence of hidden attack surfaces. Companies, especially those with thousands of engineers, often suffer from shadow IT, where assets are deployed without proper inventory or security oversight. These assets, including obscure subdomains, deep API endpoints, and third-party integrations, often go unnoticed by standard enumeration tools and even experienced security researchers. Kültekin points out that traditional methods like passive enumeration (which misses wild-card certificates or internal DNS records) and brute-forcing (limited by generic wordlists) are inherently constrained. He uses the example of Apple's subdomains, highlighting how unique naming conventions (e.g., iOS-MDN.apple.com where MDN stands for "Made in North Carolina") make it nearly impossible to guess without specific contextual understanding. The talk underscores that current approaches are resource and time-consuming, lacking the crucial manual context awareness needed to effectively uncover these elusive assets.

Key Findings

▶ Watch: Why mapping web attack surfaces is so hard (3:00)

Kültekin's research demonstrates that Large Language Models (LLMs) offer a superior approach to web attack surface enumeration compared to traditional methods or even simpler AI models like LSTMs. The primary finding is that LLMs, when provided with sufficient context and fine-tuned on relevant data, can effectively learn target-specific naming patterns, abbreviations, and conventions to generate highly realistic and previously undiscovered subdomains and API paths. This capability stems from their core mechanisms of next word prediction, distributional semantics, and transformer architecture with self-attention.

A crucial insight is the importance of providing context to LLMs. Simply asking an LLM "What does MDN stand for?" yields generic, often incorrect, answers. However, by feeding the LLM a list of Apple subdomains that include geographical indicators (like Miami, New York, RNO for Reno, Nevada), the LLM can infer that MDN in iOS-MDN.apple.com is likely a location abbreviation, not a technical term like "Mobile Device Network." This contextual understanding allows the LLM to make much more intelligent and accurate predictions, leading to the discovery of highly relevant, yet previously unknown, assets. The enumeraite tool leverages these findings to construct an agentic structural enumeration process, where LLMs deconstruct observed assets, infer patterns, and then intelligently generate new candidates, significantly expanding the attack surface map.

Technical Deep Dive

▶ Watch: Uncovering hidden attack surfaces and exponential subdomain growth (5:00)

The limitations of traditional web enumeration methods are stark. Kültekin recounts a personal experience where he encountered an API endpoint: API/userCRT. Standard wordlists like SecLists contained user_create or user_created, but none matched the abbreviated, capitalized userCRT format. This highlighted a critical gap: traditional brute-forcing relies on pre-defined dictionaries, which often lack the specific naming conventions, abbreviations, and contextual variations used by individual development teams. Manual enumeration, while effective, is time-consuming and limited by human cognitive capacity.

Kültekin argues that AI, particularly LLMs, are a perfect fit for this problem due to their fundamental design principles:

1. Next Word Prediction: LLMs are designed to predict the most probable next token based on context and statistical patterns. If given target.com/admin/, an LLM can predict dashboard, settings, users, or reports as likely subsequent paths.
2. Distributional Semantics: This concept states that words appearing in similar contexts tend to have similar meanings. LLMs convert words or tokens into vectors, where the "angle" between vectors indicates semantic similarity. For instance, admin and user would have a smaller angle (more similar) than admin and CSS. Contextual embeddings further enhance this by generating vectors based on the entire sentence or sequence, allowing for a deeper understanding of meaning beyond individual tokens. Kültekin demonstrated this with an example: API/user_DLT (user deletion) is semantically closer to API/ADM_CRT (admin create) in an LLM's understanding (0.5 similarity) than to API/user_remove (0.3 similarity). This is because the LLM recognizes the consistent abbreviation pattern (DLT for delete, CRT for create) and capitalization, even across different entities (user vs admin).
3. Transformer Architecture and Self-Attention: Modern LLMs rely on transformer architecture, which uses self-attention mechanisms to consider long-range dependencies across input sequences. When generating a new token for API/v1/users/, the LLM doesn't just look at users but also API and v1, allowing it to suggest API/v2/accounts/ by understanding versioning and entity changes.

Kültekin explored various AI models in his research:

• ChatGPT API: While powerful and capable of generating context-aware suggestions (e.g., poker-related subdomains from poker-related seeds), its usage is prohibitively expensive for large-scale enumeration.
• Long Short-Term Memory (LSTMs): These are recurrent neural networks designed for sequential processing with a basic memory mechanism. Kültekin trained an LSTM on Apple subdomains. While it could predict student2.apple.com from student1.apple.com, it struggled to understand semantic relationships like student and edu being related, due to its sequential, token-by-token processing. Limitations included difficulties with unseen tokens and a lack of creative generalization. He referenced the "Offensive AI" paper by Castagnoro et al. as an underrated work in this area.
• nanoGPT: A lightweight framework for training LLMs from scratch. Kültekin used a 10.6 million parameter model with Apple subdomains, showing it could generate plausible, unseen subdomains. He also mentioned "Service" by Hadrin company, which uses a nanoGPT model (70 million parameters, 26 million tokens) claiming up to a 10% increase in discovered subdomains.
• GPT2: A pre-trained model with 100-700 million parameters, already familiar with web text. Fine-tuning GPT2 showed some logical generations, but Kültekin felt it still lacked the desired level of contextual understanding, especially for complex patterns like IP addresses.
• Qwen 7B: This model was ultimately chosen for enumeraite due to its larger size (7 billion parameters, though Kültekin mentioned "34 billion" at one point, likely a slip for Qwen's capabilities), modern transformer architecture, good statistical performance among open-source models, and support for long context lengths. Qwen 7B was extensively trained for enumeraite on:
• Subdomain Enumeration: Over 5,000 domains and 22 million subdomains.
• Path Enumeration: Over 600,000 domains/subdomains and 28 million paths.

The training data was structured to provide explicit context, for example: "domain name is portiger and related subdomains are like this."

Demo / Proof of Concept

▶ Watch: Reverse engineering target-specific subdomain naming conventions (Apple MDN) (6:00)

Kültekin demonstrated enumeraite's capabilities through several practical scenarios:

1. Direct Path Generation:

• User Prompt: Given known paths like login, cart, checkout, product (implying an e-commerce site), suggest 10 more realistic paths.
• LLM Output (Qwen 7B preset): products, clothes, accessories, bags, wishlist, contact, account, orders. These results align well with the e-commerce context. Kültekin also showed an example where a less-tuned model generated less relevant or nonsensical paths, highlighting the importance of fine-tuning.

1. Direct Subdomain Generation:

• User Prompt: Given shop.example2.com and dev.example2.com, generate 10 more subdomains.
• Generic LLM Output: admin, blog, support, mail, contact, help, docs. While plausible, these lacked the "development/staging" context implied by dev.example2.com.
• Fine-tuned LLM Output (Qwen 7B): account-dev, accounts, api-dev, API-staging, API-test-staging, API-dev. This output demonstrated a much deeper understanding of the input context, generating highly relevant development- and API-related subdomains.

1. Agentic Structural Enumeration (Subdomains): This advanced technique uses a multi-LLM agent to deconstruct and intelligently fuzz.

• Input: A single real subdomain, e.g., activate-iphone-use-1-cx0002.apple.com.
• Agent 1 (Pattern Inference): Deconstructs the subdomain into symbolic slots: activate-[action]-[product]-use-[region_ID]-[CX_cluster_ID].apple.com. It identifies variable slots like action (activate, enable, register, setup), product (iPhone, iPad, Mac, Watch), region_ID (digits), and CX_cluster_ID (digits with leading zeros).
• Agent 2 (Combination Generation): Uses its internal knowledge (trained on Apple data) to create intelligent lists for each variable slot (e.g., Mac, iPod, iPad for products). It then iterates over possible combinations to generate realistic subdomain variants, such as enable-iPad-EUW1-Pro01.apple.com. This demonstrates a sophisticated approach to generating contextually accurate and highly specific targets.

1. Semantic Endpoint Discovery (Paths): Similar to subdomains, this process takes a single observed path and intelligently expands it.

• Input: API/v2/userCRT.
• LLM 1 (Pattern Extraction): Understands versioning (v2), entity (user as an abbreviation), and action (CRT as an abbreviation for create with capitalization). It extracts potential variable slots.
• LLM 2 (Path Generation): Based on the extracted patterns, it generates new, consistent paths. For example, knowing userCRT means user creation, it can infer ADM for admin and DLT for delete, leading to suggestions like API/v1/adminDLT.

Kültekin announced that new models and features will be released, including a 1.3 billion parameter model for local execution, categorized training data (e.g., tech, finance, automotive) to improve cross-domain relevance, and prioritization based on enumeration results (e.g., login-dev marked as high severity). An "agentic target analyzer" will also be developed. All models and tools will be open-sourced under the enumeraite project on GitHub and accessible via enumeraite.com.

Defensive Implications

▶ Watch: Why LLMs need context for accurate subdomain decoding (8:00)

The findings presented in the enumeraite talk carry significant implications for defensive security strategies. The prevalence of shadow IT and the sheer scale of modern web applications mean that organizations often "can't protect what they don't know exists." Traditional asset discovery methods, limited by static wordlists and passive collection, frequently miss obscure subdomains, internal APIs, and development environments that are inadvertently exposed to the internet.

enumeraite provides a powerful new capability for proactive attack surface management. By leveraging LLMs to intelligently infer and generate highly probable, yet hidden, web assets, defenders can gain a more comprehensive understanding of their true attack surface. This allows security teams to:

• Identify unknown assets: Discover forgotten or uninventoried subdomains and API endpoints that could serve as entry points for attackers.
• Prioritize remediation: Understand the context and potential risk of newly discovered assets (e.g., a dev or admin endpoint) to prioritize security efforts.
• Improve inventory accuracy: Augment existing asset inventories with AI-generated candidates, leading to a more complete and accurate picture of an organization's digital footprint.
• Anticipate attacker methods: By using similar techniques to those an advanced attacker might employ, defenders can get ahead of potential threats and secure assets before they are exploited.

Ultimately, enumeraite empowers defenders to shift from a reactive to a proactive posture, ensuring that their security controls encompass the entirety of their exposed web infrastructure.

Key Takeaways

• Traditional enumeration methods are insufficient: Static wordlists and passive reconnaissance struggle to keep pace with the dynamic, context-specific naming conventions of modern, complex web attack surfaces.
• LLMs excel at context-aware generation: Large Language Models, leveraging next word prediction, distributional semantics, and transformer architecture, can intelligently infer and generate highly realistic and previously undiscovered subdomains and API paths.
• Context is king for LLMs: Providing LLMs with specific target examples enables them to learn unique naming patterns and abbreviations, leading to significantly more relevant and accurate enumeration results.
• Agentic structures enhance fuzzing: Multi-LLM agentic systems can deconstruct observed assets into symbolic patterns and then intelligently generate combinations for new, contextually consistent subdomains and API endpoints.
• enumeraite offers an open-source solution: The enumeraite project will release fine-tuned LLM models (including a 1.3 billion parameter version for local use) and tools, enabling security professionals to integrate AI-assisted reconnaissance into their workflows.
• Proactive discovery is crucial for defense: This AI-driven approach empowers defenders to identify shadow IT and hidden assets, ensuring a more comprehensive understanding of their attack surface and enabling proactive security measures.

About the Speaker(s)

Özgün Kültekin is an Offensive Security Engineer at Trendial Group, one of the largest e-commerce companies. In his daily role, he reviews a wide array of products, from Active Directory to desktop applications. Outside of his professional work, Kültekin is an active bug hunter, focusing on web security and AI research. He has presented his work at several prominent security conferences, including Defcon 32 Red Team Village, MRA Activity, and various B-sides conferences across Europe. His research for enumeraite was significantly aided by Aljenr, a Senior Staff Engineer at Trendial, known for his work on cyber security-trained LLMs like senm and baron LLM.