Inventory your own attack surface

1. List the apps, libraries, local listeners, public pages and repositories that you maintain.

2. For each local service note its purpose, bind address, port, version and intended audience.

3. Inspect configuration for development-only services accidentally exposed beyond localhost.

4. Do not assume a domain belongs to you unless it is documented in your authorization.

5. Exercise: make a simple asset table and mark each entry verified, unknown or retired.

Scope: Education and testing on owned or explicitly authorized systems only.