Asset Models

TestNet categorizes enterprise assets into 8 core models. Each asset is connected through cascading relationships (e.g., Company -> Domain -> Subdomain -> IP -> Port -> Web -> API/Vulnerability) to form a complete attack surface chain.

---

1. Overview of the 8 Asset Models

The core business fields, automatic linkage rules, and risk indicators for each model are summarized below:

Asset Model	Entity Identifier	Core Business Fields	Cascading Relationship Rules	Key Risk Indicators
🏢 Company (company)	Corporate entity / branch	• Company name companyName • Asset manager assetManager & department assetDepartment • Source source & comment comment	Downstream: automatically aggregates primary domains, subdomains & IP assets	Unmonitored subsidiary branches, data leaks
🌐 Domain (domain)	Root / primary domain	• Domain domain & ICP filing number icpNumber • Whois info whois & DNS servers dnsServer • Linked company companyId	Upstream: Company. Downstream: all subdomains (subdomainCount auto-computed)	Impending expiration, DNS hijacking risks
🔗 Subdomain (subdomain)	DNS record / hostname	• Subdomain subDomain & record type type • DNS record dnsRecord & name server nameServer • Label assetLabel & level level	Upstream: Domain (domainId). Downstream: points to IPs or Web applications (ipCount/webCount auto-computed)	Wildcard exposure, takeover of abandoned subdomains
💻 IP Address (ip)	Host / network IP	• IP address ip & IPv6 flag isIpv6 • Public/private isPublic & ISP isp • Geolocation province/city/country/region	Upstream: Subdomain. Downstream: exposed port services (portCount auto-computed)	Publicly exposed management subnets, abnormal geolocations
🔌 Port Service (port)	Network listener	• Port port & protocol protocol • Service service, product product & version versionStr • Banner banner & web flag isWeb	Upstream: IP (ipId). Downstream: hosts Web sites or bottom-layer APIs	High-risk exposed ports (e.g., 22, 3389, 6379, 27017)
🌍 Web App (web)	HTTP(S) site / system	• URL url & page title title • Status code httpStatus & content length contentLength • Tech stack tech, web server webServer & CDN detection isCdn/cdnName • Screenshot screenshotUrl & icon hash faviconHash	Upstream: Subdomain & Port (subDomainId/portId). Downstream: API endpoints & Vulnerabilities	Unauthenticated admin panels, outdated vulnerable frameworks
⚡ API Endpoint (api)	REST / RPC route	• Path apiPath & HTTP method httpMethod • Name apiName & content type contentType • Request/response examples requestBodyExample/responseBodyExample	Upstream: Web application (webId), optionally organized in directory trees (treeId)	Broken object level authorization (BOLA), plaintext secrets
🛡️ Vulnerability (vul)	Security threat / flaw	• Name (vulName) & type (vulType) • Severity (severity: CRITICAL - INFO) • Remediation status (fixStatus: OPEN/CONFIRMED/FIXED/INVALID/ACCEPTED) • PoC evidence vulPayload / Advice fixSuggestion	Attached to any target asset above via assetType + assetId	Unpatched CRITICAL or HIGH severity vulnerabilities

---

2. Common Core Entity Attributes

All 8 asset models share the following common properties:

{
  "id": "Unique identifier (String)",
  "projectId": "Context ID of the parent Project",
  "assetLabel": "Comma-separated labels (e.g., Core Business,Production,High-Def CDN)",
  "assetManager": "Asset owner",
  "assetDepartment": "Owning department",
  "status": "ACTIVE / INACTIVE",
  "source": "Asset source (auto-capture / scanner report / manual entry)",
  "lastVerified": "Last-alive verification time",
  "createTime": "2026-07-16 10:00:00",
  "updateTime": "2026-07-16 10:15:00"
}

TIP

Multi-dimensional Tagging: Using the assetLabel field, users and automated tasks can freely categorize assets. System tagging rules (see Asset Rules) automatically attach tags such as ThinkPHP, Spring Boot, or High Risk based on fingerprinting results.

---

3. Automatic Upstream/Downstream Resolution

TestNet supports asset cascading resolution:

1. When a scanning task takes a Company or Primary Domain as target, the engine automatically expands the graph downwards;
2. It retrieves all active subdomains, IPs, and open Web URLs under that hierarchy in one pass—no manual page switching or pagination clicks required;
3. Any node changes can be visualized in real-time within the Asset Topology Graph as a visual graph, where nodes with CRITICAL/HIGH vulnerabilities glow red for immediate awareness.