The 4 Step Guide to Exploring Attacker Infrastructure with Web Assets

This article explains a technique for enumerating attacker infrastructure by fingerprinting web assets (JavaScript/CSS/image paths) embedded in HTML. The author demonstrates pivoting from a malicious site using a unique asset path, leveraging Iris/DomainTools to surface related domains (for example, linking domains via shared SOA email), and advises building allowlists and examining code-level artifacts to improve confidence and reduce false positives.