See your external attack surface through an attacker’s eyes

We discover your internet-facing assets, build attack scenarios using live intelligence, and test only the systems you have authorized in writing.

Service model
Black-Box and Red Team by quotation
Discuss your needsExplore attack surface management

Written authorization scope

  • Assets to be tested
  • Permitted methods
  • Testing windows

Drafted together with your organization before testing begins.

  1. Discovery

    Subdomains, IPs, DNS and Shadow IT

  2. Testing

    Controlled simulations using live intelligence

  3. Deliverables

    Red Team Report, PoC and remediation guidance

    PoC: evidence showing how a vulnerability was exploited.

Retest after remediation

From discovery to attack simulationExternal discovery and live intelligence feed realistic attack scenarios performed by security analysts.

How we work

We combine external asset discovery with analyst assessment and authorized security testing.

  1. Agree the scope

    We agree the target assets, permitted methods and testing window, and confirm written authorization.

  2. Test attack paths

    We use external exposure and intelligence findings to design attack scenarios, then run black-box tests and red team engagements against the authorized targets.

  3. Share the findings

    We document verified attack paths with evidence and review technical fixes and priorities with your team.

What does the Red Team report include?

Attack paths in the report are validated only against targets within the written authorization scope.

Validated vulnerabilities are retested after remediation.

Report sections

  1. Steps taken by the attacker
  2. Data that could be accessed
  3. Exploited vulnerabilities
  4. PoC evidence and screenshots
  5. Technical remediation recommendations and business impact
Schematic view of the report structure; contains no real findings.

Detailed service description

LeakData Sur maps, analyzes and manages all your internet-facing digital assets from an attacker's perspective. Modern attacks exploit forgotten systems, open ports and outdated external vulnerabilities. By combining open-web and Dark Web intelligence with External Attack Surface Discovery, Sur delivers a real attack simulation tailored to your organization. LeakData security analysts use this live intelligence to attempt access like a real attacker through Black-Box testing, turning passive CTI notifications into practical attack scenarios.

Areas of work

From asset discovery to controlled attack simulation, examine external risks with supporting evidence.

By quotation

Discovery

Finds internet-facing assets, services, and vulnerabilities.

  • Automated Discovery

    Forgotten subdomains, IP ranges, DNS records and exposed web data belonging to your organization are scanned periodically.

  • Open Port and Service Analysis

    Dangerous internet-facing ports (RDP, SSH, FTP), outdated software and exposed critical service information are identified.

  • Vulnerability Scanning

    Expired or weak SSL/TLS certificates, misconfigured services and known vulnerabilities (CVE) are detected, alongside unique flaws in custom web applications and services beyond published CVEs.

Controlled testing

Tests discovered weaknesses using live intelligence, within the authorized scope.

  • Credential-Driven Exploitation

    Corporate email addresses, passwords and session cookies found on the Dark Web, hacker forums and Stealer Log markets are used in controlled penetration tests against VPN, OWA, SSO and RDP portals.

  • Vulnerability Exploitation

    Analysts test access through open ports, outdated services, misconfigurations and forgotten Shadow IT. They manually test Business Logic Flaws, privilege escalation and data exfiltration paths that automated tools miss.

  • Social Engineering & Spear-Phishing Tests

    Leaked VIP/executive information and corporate context inform targeted social engineering scenarios involving employees.

Validation and reporting

Separates out truly exploitable vulnerabilities and reports them with evidence.

  • False-Positive Elimination

    Testing identifies genuinely exploitable critical flaws, beyond catalogued vulnerabilities, and prioritizes business impact without unnecessary alert fatigue.

  • Management and Technical Reporting

    A Red Team Report documents attack steps, exposed data and exploited weaknesses, with PoC (Proof of Concept) evidence, screenshots and detailed remediation guidance.

Service coverage

We investigate attacker paths across internet-facing assets, from discovery and exploitation to evidence-based reporting.

Included work

  • Discovery of subdomains, IPs, DNS, open ports, services and SSL/TLS
  • Credential-Driven Exploitation, business logic and Spear-Phishing tests
  • Exploitation evidence, screenshots and technical remediation reports

Delivery and follow-up

  • Test targets, methods and schedules are agreed with your organization.
  • Black-Box scenarios run on systems covered by written authorization.
  • Verified flaws are ranked by business impact and retested after remediation.

About LeakData Sur

How does Sur differ from a routine vulnerability scan?

Sur turns discovery and live intelligence into Black-Box simulations. Analysts test real access paths through Shadow IT, business logic flaws and leaked credentials.

How is leaked data used in testing?

Corporate email addresses, passwords and session cookies found on the Dark Web, hacker forums and Stealer Log markets are tested in controlled scenarios against authorized VPN, OWA, SSO and RDP targets.

What evidence does the Red Team Report contain?

It records attack steps, accessible data, exploited flaws, PoC evidence and screenshots. Each finding includes remediation guidance and business impact.

Test your external attack surface with real scenarios

Set the Black-Box scope and Red Team schedule for your internet-facing systems.

Talk to usExplore attack surface management