Worked Example: NRECA Domain Discovery

This example demonstrates the Module 2 external attack surface discovery workflow using NRECA (National Rural Electric Cooperative Association) as the target organization. All data shown is derived from publicly available sources.

Related module: Module 2: External Attack Surface Discovery

Step 1: Certificate Transparency Search

Tool: crt.sh

Query: %.electric.coop and %.cooperative.com

The CT search reveals the domain structure. NRECA operates under multiple root domains:

Key finding: The email domain (nreca.coop) differs from the public website domain (electric.coop). Searching only the website domain would miss all personnel breach exposure.

CT Analysis Results

Public-Facing / Content:

• electric.coop – primary public website
• www.electric.coop – www redirect
• remagazine.cooperative.com – RE Magazine content platform
• careers.electric.coop – job postings and recruitment
• nrecainternational.coop – international programs

Member/Employee Portals (Login Required):

• cooperative.com – member portal (SharePoint-based)
• benefits.cooperative.com – employee benefits enrollment
• resap.cooperative.com – Rural Electric Safety Achievement Program
• ecba.cooperative.com – Electric Cooperative Bar Association

Wildcard Certificates:

• *.cooperative.com – covers all subdomains under cooperative.com
• *.electric.coop – covers all subdomains under electric.coop

These wildcards mean CT logs undercount the actual subdomain footprint. DNS enumeration tools are required to find subdomains covered by these wildcards.

Certificate Authorities:

• DigiCert – enterprise certificate management (primary domains)
• Let’s Encrypt – automated/free certs (some subdomains, may indicate cloud-hosted or developer-managed services)
• Sectigo – specific portals

Step 2: Subdomain Enumeration

Tools: Subdomain Finder, DNSDumpster, SecurityTrails

Critical finding: electric.coop returned only 2-3 subdomains. cooperative.com returned 100+ subdomains exposing authentication infrastructure, benefits systems, financial portals, staging environments, and deployment architecture. The member-facing domain is far richer for reconnaissance than the public website.

Authentication / Identity

Benefits / HR (High-Value PII Targets)

This cluster represents a massive PII exposure surface. Benefits systems typically contain SSNs, banking details, salary data, and family information.

Financial / Compliance

Staging / Test (Often Less Secured)

Identity infrastructure test instances (pae-ext-test, pfe-ext-test) are high-priority findings – staging and test environments frequently have weaker authentication or default credentials.

Infrastructure Architecture

Blue/green deployment: Extensive blue.* subdomain pattern (blue.benefits, blue.retirement, etc.) reveals blue/green deployment architecture, telling an adversary how the organization manages releases and where redundant infrastructure exists.

IP clustering: The majority of cooperative.com subdomains resolve to 74.127.88.162, suggesting centralized hosting or a load balancer. A small number resolve to different IPs, indicating cloud-hosted or externally managed services.

Step 3: Remote Access Identification

Tools: Shodan, Censys

Example documentation for a discovered remote access service:

This finding connects directly to Module 4, where the product and version are correlated against vulnerability databases.

Step 4: Google Dork Queries

Example queries generated for NRECA domains:

Login Pages and Authentication Portals:

• site:cooperative.com inurl:login
• site:cooperative.com intitle:"sign in" OR intitle:"log in"
• site:electric.coop inurl:auth OR inurl:sso OR inurl:portal

Exposed Documents:

• site:electric.coop filetype:pdf "confidential" OR "internal use only"
• site:cooperative.com filetype:xlsx OR filetype:csv

VPN / Remote Access / OT References:

• "electric.coop" OR "cooperative.com" inurl:vpn OR inurl:remote
• site:electric.coop "SCADA" OR "EMS" OR "substation" OR "FortiGate"

Key Takeaway

Searching only electric.coop would have found 2-3 subdomains. Searching cooperative.com revealed authentication infrastructure, benefits/PII systems, financial portals, staging environments, and deployment architecture. Always enumerate all known root domains.