Documentation / Application Security

Attack Surface Assessment

The Attack Surface Assessment (also called the Reachability Test) runs as the first step of every PAC pentest. It uses nmap to confirm the target is online, discover open ports, and auto‑load only the custom attacks that match the services it finds — saving time and avoiding noise.

Before you start

A PAC configuration file ready in PAC Management.
Network access from the Prancer scanner to the target host.
Familiarity with PAC Wizard and Custom Attack Auto Tagging.

How it works

1. The PAC CLI receives the PAC config file from the commander. 2. Before scanning starts, the Reachability Test runs nmap against the target. 3. If the host is unreachable, the run is halted and reported back to the commander — no findings are produced. 4. If the host is reachable, open ports are mapped to their default services using the nmap-services database (e.g. port 22 → ssh, port 80 → http). 5. Detected services are written as tags into the PAC config; the CLI then loads any custom attacks that match those tags.

!Reachability Test

Note: Service-to-port mapping follows the official nmap-services file. Use this same vocabulary when writing tags for custom attacks so they auto-load correctly.

Validate reachability manually

Use this script to mirror what Prancer does, before kicking off a scan:

#!/bin/bash
# Usage: ./reachability.sh <public-ip-address>
if [ -z "$1" ]; then
    echo "Usage: $0 <public-ip-address>"
    exit 1
fi

IP_ADDRESS="$1"
OUTPUT_FILE="scan_results_$IP_ADDRESS.txt"

nmap -p 1-65535 -sV -sC -O -oN "$OUTPUT_FILE" "$IP_ADDRESS"

OPEN_PORTS=$(grep -E "open|filtered" "$OUTPUT_FILE" | wc -l)
if [ $OPEN_PORTS -gt 0 ]; then
    echo "The host at $IP_ADDRESS is exposed."
    echo "Evidence: $OUTPUT_FILE"
else
    echo "No exposed services were found on $IP_ADDRESS."
fi

Tip: Run this script from a machine with the same network reach as the Prancer scanner — results from a different network may differ.

Why it matters

By verifying reachability and tagging open services up front, PAC avoids wasting compute on dead targets, runs only the attacks that apply to the discovered surface, and produces cleaner, more accurate findings.

Attack Surface Assessment