enumeraite: AI Assisted Web Attack Surface Enumeration

Introduction to Innumerite: AI-Assisted Web Attack Surface Enumeration

Osgun Kling, a security researcher, introduces Innumerite, an AI-assisted tool designed to enhance web attack surface enumeration. The talk emphasizes using AI effectively, not excessively, to redefine reconnaissance processes.

Understanding Web Attack Surfaces

A web attack surface encompasses all accessible elements an attacker can interact with, including paths, subdomains, API endpoints, CDNs, and third-party integrations. Challenges in mapping these surfaces arise from the "shadow IT" problem in large organizations, forgotten assets, and a lack of comprehensive inventory. Companies cannot protect what they don't know exists.

The Enumeration Challenge

Discovering all functionalities of a web application is a significant challenge, often referred to as "enumeration hell." Traditional methods struggle with the sheer volume of subdomains and endpoints, the complexity of various frameworks, and the difficulty of prioritizing assets. Hidden attack surfaces, such as obscure subdomains or endpoints, are particularly hard to find. For example, Apple's complex subdomain naming conventions, like ios-mdn-apple.com, require reverse-engineering naming logic and creative subdomain generation, which traditional brute-forcing often misses.

Limitations of Traditional Methods

Traditional enumeration methods have several drawbacks:

Passive Reconnaissance: Cannot discover subdomains protected by wildcard certificates or internal assets in SSRF scenarios.

Brute Force: Limited by static wordlists, which are often reused across different targets.

Resource and Time Intensive: Requires significant manual effort and computational resources.

Manual Context Awareness: Relies heavily on the researcher's ability to infer naming conventions and patterns.

This leads to situations where manual, creative enumeration can uncover critical vulnerabilities missed by automated tools, as illustrated by the anecdote of finding an unauthenticated admin panel on a random subdomain for a significant bounty.

Leveraging AI for Smarter Enumeration

AI, particularly Large Language Models (LLMs), offers a powerful solution for these challenges due to their ability to understand context, predict probable sequences, and grasp semantic relationships.

AI's Strengths in Enumeration

Next Word Prediction: LLMs excel at predicting the next most probable token based on context and statistical patterns, useful for generating potential subdomains or paths.

Distributional Semantics: LLMs can represent words as vectors, allowing them to understand that semantically similar words (e.g., "admin" and "user") have closer vector representations than dissimilar ones (e.g., "admin" and "CSS").

Contextual Embeddings: Understands words within the entire sentence or sequence, not just in isolation.

Transformer Architecture: Modern LLMs use transformers, enabling them to consider long-range dependencies and the entire input context for more intelligent generation.

AI-Powered Techniques

Subdomain Generation: LLMs can suggest new subdomains based on observed patterns and context. For instance, if given shop.example.com and dev.example.com, an LLM can generate development-related subdomains like api-dev or staging-api.

Path Enumeration: Similar to subdomains, LLMs can generate realistic API endpoints or URL paths based on observed examples. For an e-commerce site, given login, card, and checkout, an LLM can suggest products, accessories, account, and orders.

Agentic Structural Approach: This advanced technique uses multiple LLMs in a pipeline. One LLM deconstructs an input (like a single subdomain or path), identifies patterns and variable slots, and passes this information to a second LLM. The second LLM, trained on relevant data, then generates realistic and creative variants based on the inferred structure and its knowledge base. This allows for highly specific and novel enumeration, even from a single example.

Model Choices and Training

LLMs vs. LSTMs: While LSTMs (Long Short-Term Memory networks) can process sequences, they lack the contextual understanding and creativity of LLMs. LLMs can infer relationships (e.g., that "student" and "edu" are related) that LSTMs might miss.

Model Selection: The talk discusses using models like NanoGPT, GPT-2, and larger models like GPT-4 (34 billion parameters), highlighting the trade-offs between size, pre-training, and performance. Fine-tuning these models on specific datasets (e.g., Apple's subdomains) significantly improves their relevance.

Training Data: Models are trained on large datasets of domains, subdomains, and paths to learn naming conventions and common structures.

Innumerite's Features and Releases

Innumerite aims to provide:

Open-Source Models: Releasing models trained for subdomain and path enumeration, including smaller, locally runnable versions (e.g., 1.3 billion parameters).

Categorized Data: Organizing training data by industry (tech, finance, etc.) for more targeted enumeration.

Prioritization: Ranking enumeration results based on likelihood and potential impact (e.g., login-dev marked as high priority).

Agentic Target Analyzer: An LLM-based component to answer questions about target web releases.

The project's resources, including models and code, will be published on GitHub and accessible via enumerate.com.

Acknowledgements

The speaker thanks Aljenr, inventor of the "senm" and "baron" LLMs, for his significant contributions to the AI aspects of this research.