DEV Community

jeffrey
jeffrey

Posted on

35,111 responses contain the AD FS login path, and 20,623 of them answer on 443

#zoomeye #exposuremeasurement #identity

35,111 responses contain the AD FS login path, and 20,623 of them answer on 443

Active Directory Federation Services is the component that turns a Windows domain account into a token another application will accept. Its login endpoint is a fixed path, which makes it unusually easy to count and unusually important to place correctly.

The measurements

Taken 27 October 2026, sub_type=all, one page request per query:
| Query | Total |
| --- | ---: |
| http.body="/adfs/ls" | 35,111 |
| port="443" && http.body="/adfs/ls" | 20,623 |
| title="adfs" | 290 |
| ssl.cert.subject.cn="adfs" | 53,359 |

Reading the certificate figure first

The certificate count is the most interesting and the least specific. Naming a certificate's common name after the service is a habit, and the habit extends to the organisations that built the host. A certificate whose subject common name contains adfs may belong to a federation server, to a load balancer in front of one, to a mail gateway named after a company's AD FS project, or to an internal host whose certificate was issued from a template.
Fifty-three thousand certificates are not fifty-three thousand federation servers. The figure measures how often an administrator chose a particular name, which is a real signal about intent and a poor population count.

Why the body query is narrower and the port split matters

/adfs/ls is the path the login endpoint answers on. Its presence in a response body indicates a page that references that endpoint, which in practice means a login form, a redirect notice or an error page from the service itself. That makes it a better marker than a product name, and the port split is informative: roughly 59 percent of those responses are on 443, and the rest are on other ports, which includes reverse proxies terminating TLS elsewhere and internal deployments indexed by mistake.
The title count of 290 is small because the AD FS sign-in page is usually branded with the organisation's own name rather than the product's. That is deliberate on Microsoft's part and it also makes the title query nearly useless for inventory.

What an AD FS server is worth to an attacker

It is the trust anchor for single sign-on. Compromise of the signing key or of an administrative account on the server allows an attacker to mint tokens that every relying party will accept, without touching any of those applications. That property is why federation servers are treated as tier-zero assets in Microsoft's own administrative model.
The external surface is deliberately small. The login endpoint must be reachable for users to authenticate, and almost everything else should not be. The configuration that matters is which endpoints are published through the proxy and whether the server itself is reachable directly rather than only through a Web Application Proxy.

A concrete check for a hybrid estate

List the federation service name and every published endpoint. Confirm that the only path reachable from the internet is the login endpoint and its required supporting paths. Then verify that the server's own administrative interfaces are restricted to a management network and that administrative accounts are not valid for interactive logon elsewhere.
On the certificate side, review what the common names actually reveal. A certificate issued with a service name on a host that no longer runs the service is a leftover, and leftovers are where inventory drift shows up first.

Keeping the count comparable

Record the four queries, the date and the interface. The body query is the one to watch monthly, because it tracks a path that changes only when the service is deployed or removed, which makes a delta meaningful.

References

Top comments (0)