Mapping the SaaS Attack Surface
summary
Claims a reproducible SaaS attack surface procedure and releases an open‑source tool plus a tenant-to-vendor database. Techniques combine DNS/SSL artifacts (MX, TXT, SPF, CNAMEs, certificate transparency), subdomain brute force with sapfinder (Project Discovery), passive DNS, JS imports and CSP analysis, GitHub/sourcegraph searches, dark‑web credential dumps, and SSO enumeration (IDP vs SP flows). Example: NVIDIA surfaces north of 100 SaaS applications found; recommends deleting validation DNS records, randomizing tenants, enforcing SSO and MFA, and using SSO canaries.
AI-written summary · about
chapters (12)
- 0:00Introduction to SaaS attack surface
- 1:24What is attack surface management
- 2:27DNS records for SaaS validation
- 5:58Discovering subdomains and CNAMEs
- 8:04Mapping SaaS provider tenants
- 10:32SSO and tenant identification
- 14:27Expanding SSO-based applications
- 17:22Why SaaS attack surface matters
- 21:44Reducing SaaS attack surface risks
- 24:14SAS provider security best practices
- 26:41Live demo of mapping techniques
- 27:45Q&A session
related talks
46mCritical SaaS, Critical Blind Spots: A Detection Engineer's Field Guide to SaaS Attacks
48mMonitoring Application Attack Surface and Integrating Security into DevOps
48mTwo Steps Forward for SaaS Adoption, One Step Back for Security
39mRed Teaming from outside: Identifying and exploiting SaaS systems... (Rojan Rijal)
47mPain in the Apps — Three Attack Scenarios Attackers Are Using to PWN SaaS
45mAnticipate and Defend Against Advanced Adversaries Targeting SaaS and IaaS
46mHow to Adapt to Security Changes in Cloud SaaS Transformation
58mCloud Attack Surface Management