Attack Surface overview¶
SQUR Attack Surface is a free external scanner. You enter a domain, and in about 60 seconds you get a map of the hosts, services and configuration an attacker would see from the outside, ranked by what stands out.
It lives at asm.squr.ai and inside the SQUR app under Attack Surface.
What it does¶
- Maps your exposure. It finds subdomains and public-facing assets, then checks each one: TLS, security headers, open ports and exposed services, email authentication (SPF, DKIM, DMARC), technology and software versions, login panels, possible subdomain takeover, and exposed sensitive files.
- Ranks what stands out. Each scan names a recommended first target and lists the top priorities, in plain language, with guidance on what to review next.
- Hands off to a pentest. Any host on the map can become a pentest target in one step. See Send a host to a pentest.
The scan page states how many checks a scan runs. The number differs between a scan without an account and a scan from a signed-in account.
What it does not do¶
Attack Surface is passive. It reads what is publicly reachable.
- It never logs in to your application and never sends an attack or payload.
- It does not test authentication, injection, access control (IDOR, BOLA) or business logic.
- It cannot confirm that anything is exploitable. Its results are exposures and indicators, not findings.
Only a pentest proves what is exploitable. That is why SQUR marks everything the scan surfaces as Unverified when it appears inside a pentest setup.
Scanner and pentest are different products
Attack Surface is a scanner. SQUR Pentest is not. The scan tells you where to look. The pentest tries the doors and shows a working exploit for every confirmed finding.
Without an account and with one¶
| No account | Free SQUR account | |
|---|---|---|
| Cost | Free | Free |
| Checks | The shorter public set | The full set, including full subdomain enumeration, top-100 port scan, DNS and WHOIS records, subdomain takeover, sensitive files and CVE matching |
| History | Share link only | Private scan history per organization |
| Re-checks | None | Your scopes are re-checked weekly |
| Evidence detail | Titles and severity for all items, detail for the top target | Full detail |
Authorization¶
Every scan starts with a confirmation that you own the domain or are authorized to scan it. Scans from a signed-in account can additionally require proof of ownership: you add a DNS TXT record to the domain, and SQUR verifies it. Until ownership is proven, a scan may run in a reduced, passive mode.
Only scan domains you own or are allowed to test.
Where to go next¶
- Run an attack surface scan
- Read the results
- Send a host to a pentest
- Plan a pentest program for the whole portfolio, not one host