External Network Security
External testing covers the internet-facing footprint: DNS, mail, VPN, remote access, and hosted services. Start with reconnaissance and asset discovery-subdomain enumeration, certificate transparency, and ASN/IP range mapping-then service identification and version fingerprinting. Candidates must understand TLS configuration review (protocol versions, cipher suites, certificate validity and chain), exposed management interfaces, and the risk of forgotten shadow IT assets.
Know the common external weaknesses: outdated or end-of-life services, default credentials on appliances, unauthenticated APIs, weak VPN configurations, and mail security gaps (missing SPF/DKIM/DMARC enabling spoofing). Distinguish vulnerability identification from exploitation: a version banner suggesting a known flaw still requires confirmation that the vulnerable code path is reachable and the service is not mitigated by a compensating control.
Traps include treating a self-signed certificate as a critical vulnerability, calling an open port a compromise, and confusing DNS zone transfer exposure with subdomain takeover. Subdomain takeover requires a dangling CNAME to a deprovisioned third-party service-not just an unused name.
Worked example: status.example.com resolves via CNAME to a cloud bucket that no longer exists, and the provider lets anyone claim the name. The finding is subdomain takeover; impact is content control under the trusted domain, which can enable cookie theft or phishing. Remediation is removing the dangling record and monitoring DNS for orphaned entries. Rule of thumb: external findings are ranked by demonstrated impact-reachable, exploitable, and consequential-not by scanner severity alone.