SDF-LR04

Vulnerability Surface Crafting

expertDetection Value: criticalCost: moderateTime: 1-3 weeks⚙ Applications & Services

Description

Present controlled vulnerability surfaces on deception assets that entice adversaries to attempt exploitation. These surfaces appear to be exploitable weaknesses but are actually instrumented observation points that capture adversary tools, exploits, and techniques.

Rationale

Adversaries scan for vulnerabilities before investing time in exploitation. A deception environment with perfectly patched systems sends a signal that something is off, since real production environments almost always have at least some unpatched or misconfigured systems. Crafted vulnerability surfaces attract adversary engagement while maintaining full operational control.

Supporting Basis

Direct antecedent

Honeypot and adaptive-deception work expose apparently attractive or vulnerable services to shape interaction.

These sources establish design lineage and scope. They do not validate this record's operational effectiveness, planning estimates, environment labels, or ATT&CK relationships.

Implementation Steps

Identify relevant vulnerabilities

Based on adversary profiles, identify the vulnerability classes they are known to exploit. Focus on CVEs that match your production technology stack.

Create controlled vulnerability surfaces

Configure deception services to present vulnerable version strings and behaviors without actually being exploitable in a way that compromises isolation.

Instrument for exploit capture

Set up detailed logging that captures complete exploit payloads, tool signatures, and post-exploitation commands when adversaries attempt to exploit the crafted surfaces.

Test exploitation responses

Verify that the vulnerability surface responds to scanning tools (Nessus, Qualys, nmap) as expected and that exploit attempts are fully captured.

Technical Implementation Examples(1)

Controlled Vulnerability Surface Configuration

Ansible playbook to present a controlled vulnerability surface on deception hosts without being actually exploitable

yaml

# playbooks/craft-vulnerability-surface.yml
# Configure deception hosts to APPEAR vulnerable to specific CVEs
# without being actually exploitable. Attracts adversary exploit attempts.
---
- name: Craft Controlled Vulnerability Surface
  hosts: deception_web_servers
  become: true

  tasks:
    # Present an outdated Apache version string (CVE-2021-41773 target)
    # while actually running a patched version
    - name: Configure Apache to present vulnerable version string
      ansible.builtin.copy:
        dest: /etc/apache2/conf-available/version-mask.conf
        content: |
          # Present vulnerable version string to attract scanner attention
          # Actual Apache binary is fully patched
          ServerTokens Full
          ServerSignature On
          # Custom header to mimic Apache 2.4.49 (CVE-2021-41773)
          Header always set Server "Apache/2.4.49 (Ubuntu)"
        mode: "0644"
      notify: reload_apache

    # Present an SSH banner suggesting an older OpenSSH version
    - name: Configure SSH banner to appear outdated
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        regexp: "^#?Banner"
        line: "Banner /etc/ssh/banner.txt"
      notify: reload_sshd

    - name: Create SSH banner
      ansible.builtin.copy:
        dest: /etc/ssh/banner.txt
        content: |
          ******************************************************************
          *  NOTICE: This system is for authorized use only.              *
          *  All activity is monitored and logged.                        *
          ******************************************************************
        mode: "0644"

    # Create a robots.txt that "accidentally" exposes internal paths
    - name: Deploy revealing robots.txt
      ansible.builtin.copy:
        dest: /var/www/html/robots.txt
        content: |
          User-agent: *
          Disallow: /admin/
          Disallow: /api/v1/internal/
          Disallow: /backup/
          Disallow: /config/database.yml
          Disallow: /debug/
          Disallow: /.env
        mode: "0644"

    # Deploy a fake .env file at the "accidentally" exposed path
    - name: Plant trap environment file
      ansible.builtin.copy:
        dest: /var/www/html/.env
        content: |
          APP_DEBUG=true
          DB_HOST=prod-db-04.corp.internal
          DB_PASSWORD=Pr0d-Db#2026!xK9m
          SECRET_KEY=a3f8b2c1d4e5f6789012345678abcdef
          AWS_ACCESS_KEY_ID=AKIAIOSFODNN7DECOY01
          AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/TrapKey
        mode: "0644"

  handlers:
    - name: reload_apache
      ansible.builtin.service:
        name: apache2
        state: reloaded
    - name: reload_sshd
      ansible.builtin.service:
        name: sshd
        state: reloaded

MITRE ATT&CK Mappings

Technique	Tactic	Relationship
T1190Exploit Public-Facing Application	Initial Access	detects
T1203Exploitation for Client Execution	Execution	detects

Considerations

This is an advanced technique that requires deep understanding of vulnerability mechanics. A poorly implemented vulnerability surface may actually be exploitable.
Crafted vulnerabilities should match your production technology stack. An Apache Struts vulnerability on a network that runs only nginx is suspicious.
The goal is to capture the exploit attempt, not to be successfully exploited. Responses should simulate vulnerability without granting actual code execution.

Supported Environments

🏢On-Premise

☁Amazon Web Services

☁Microsoft Azure

☁Google Cloud Platform

🔄Hybrid Environment

Tools & Resources

Vulnerability emulation frameworks
Protocol-specific honeypots
Packet capture tools
Exploit analysis sandboxes

Related Techniques

SDF-PR03Service Emulation Engineering

SDF-DT03Behavioral Fingerprinting

Quick Stats

Phase: Lure
Difficulty: expert
Detection Value: critical
Cost: moderate
Time: 1-3 weeks
ATT&CK Mappings: 2