OS Hardening: Attack Surface Reduction Simulator

Install mode

Current mode results

Listening services (attack surface)

–

Exploitable entry points found

–

Default vs hardened

Mode	Surface	Exploitable
Default	–	–
Hardened	–	–

Services

How it works

Every service listening on a network port is a door an attacker (or a scanner) can knock on. This server ships with 13 possible services; only 3 are actually needed for its job. A default install leaves all 13 running. Hardening means disabling everything except those 3 essentials — a purely preventative step taken before anyone knows which services happen to be exploitable.

The underlying set of exploitable vulnerabilities never changes between the two modes — the same 6 services in the catalogue hold a real flaw either way. What changes is reachability: the scanner can only find a vulnerability behind a door that is actually open. Fewer open doors means fewer chances for any one of those flaws to be reachable at all.

Attack surface — the count of currently listening (open) services, regardless of whether any hold a vulnerability.
Exploitable entry points found — of the open services, how many the scanner actually confirmed as vulnerable this run.
Essential services stay open in both modes because the system's role genuinely depends on them — hardening never touches those.

DEFAULT INSTALL

Open / listening Closed / disabled Scanned — exploitable Scanned — clean

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.