Search Open Websites/Domains: recognize the technique

Lesson Purpose

What you are learning

This technique is about using public internet sources to learn about a target. Sources can include websites, search engines, social media, public code repositories, and forums. These sources may reveal people, technologies, relationships, projects, or infrastructure without directly contacting an organization-owned system.

Learning Objectives

Explain Search Open Websites and Domains in plain language.
Identify evidence a defender could review.
Choose a defensive action that fits the observed behavior.

Why This Matters

Public information has many legitimate uses. Security risk grows when secrets, credentials, internal details, or old information are left exposed. In practice, defenders compare public information with internal records, logs, inventories, and monitoring data to decide whether the information is current, expected, and useful to an attacker. The goal is not to remove all public information, but to reduce unnecessary exposure and review information that could create avoidable security risk.

OWASP Web Security Testing Guide (WSTG)

Use a repeatable web-testing method

Connect this ATT&CK training activity to the WSTG approach: establish expected behavior, identify the relevant attack surface, change one controlled input or observation at a time, compare the response with the baseline, and record evidence before drawing a conclusion.

For reconnaissance-oriented lessons such as T1595, treat reachability, exposed services, and observable application behavior as information gathering. A reachable service is evidence about exposure; it is not by itself proof of a vulnerability.

Open WSTG web security fundamentals

Exercise

Before You Practice

Practice Preparation

Use these lesson concepts for the ungraded practice activity below. You do not need outside research.

Open-source categories include public websites/search engines, social media, public code repositories, and public forums or documents.
Ask whether exposed information is current, necessary, and useful enough to an attacker that it deserves remediation.
Controls include removing secrets or credentials, minimizing internal detail, reviewing public repositories/documents, and removing stale information.

This is ungraded practice. Use the lesson material above; exact wording is not required. Identify three public-source categories that could reveal useful information. Then name one question a defender should ask about an exposure and two controls that reduce unnecessary public information. No external target interaction is required.

Knowledge Check

Check your understanding

Answer the questions shown below. You must answer at least 2 correctly before marking this concept lesson complete.

1. Which statement best describes Search Open Websites and Domains? This technique is about using public internet sources to learn about a target. This technique is about reviewing websites owned by the target organization for public information. This technique is about using public technical data services.

2. A defender is investigating activity related to the behavior described in this lesson. Which evidence set would provide the most relevant context? Public website reviews, code-repository scanning, search-engine exposure checks, and data-loss alerts Website inventories, CMS audit logs, document metadata checks, publication workflows, and secret-scanning tools Passive DNS, certificate records, routing data, vulnerability databases, and asset inventories

3. Which interpretation best avoids overstating what the observed information proves? Public information is useful but may be incomplete. Defenders should manage what they publish and protect sensitive systems without relying on secrecy. Public websites should reveal only information the organization intends to publish. Open technical databases are not automatically suspicious. Defenders can use them to compare public records with the intended environment.

4. Consider this behavior: This technique is about using public internet sources to learn about a target. Sources can include websites, search engines, social media, public code repositories, and forums. Which ATT&CK technique best matches the behavior? Search Open Websites and Domains Search Victim-Owned Websites Search Open Technical Databases

5. A defender wants to reduce or validate the risk described in this scenario. Which response is the most appropriate? Review public content and repositories for secrets or unnecessary details, then remove or rotate sensitive material Review public content before release and remove old files, sensitive metadata, and exposed secrets Compare public technical records with the current asset inventory and remove stale or unnecessary exposure

6. Which limitation should a defender keep in mind before drawing a conclusion from this evidence? Public information can be legitimate, incomplete, or outdated A public website can reveal more detail than the organization intended A public technical record may be old or may not apply to the organization's current systems

Learning Moment

Public information is useful but may be incomplete. Defenders should manage what they publish and protect sensitive systems without relying on secrecy.

Defender Perspective

Evidence sources can include the records and reports described in this lesson. Useful sources include public website reviews, repository scanning, search-engine exposure checks, social-media governance, and data-loss alerts. Check whether information was intentionally published, whether it is current, and whether secrets or credentials are exposed. Reduce risk with secret scanning, publication review, repository permissions, and removal or rotation of sensitive material. Risk reduction includes reviewing what is exposed and using controls to limit information that is not needed.

Continue Your Learning Pathway

Next Step · Continue ATT&CK Training

Continue building your reconnaissance and resource-development foundation with the next ATT&CK lesson.

Complete this lesson first. Finish the required lesson activity and knowledge check, if present, before continuing.

Return to dashboard