Default AS64512 is a safe placeholder — swap in your own target.
> Authorized targets only. The workflow is read-only (no exploitation).
Results
A downloadable Trickest-styled PDF report containing:
Findings — vulnerabilities ranked by severity (critical → info)
Scanned hosts — every host and port probed
Coverage — prefixes resolved, CIDRs expanded, templates run
Methodology — ASN → prefix → port → web → vuln pipeline
Machine-readable JSONL also emitted for export / SIEM pipelines.
Port Scan (distributed)
rustscan scans every host across all expanded CIDRs. It is distributed — resolved CIDRs fan out across the fleet so every prefix is scanned in parallel.
Edit the port list on the node to control what gets probed.
parse-ports
Parses rustscan output into clean ip:port lines, feeding the web discovery and network scan branches.
Resolve & Expand
asn-to-prefixes
Resolves ASNs → announced IP ranges via RIPEstat. Bare IPs and CIDRs pass through unchanged. Capped at 100 prefixes for safety.
mapcidr
Expands every prefix into individual host CIDRs, ready for the distributed port scan.
Vulnerability Scans (parallel)
Three nuclei branches run in parallel against the discovered hosts:
| Branch | Templates | Target |
|---|---|---|
| CVE (nuclei) | Known vulnerabilities | Live web URLs |
| Exposures (nuclei-exposures) | Misconfig · default-logins · takeovers · exposures | Live web URLs |
| Network (nuclei-network) | Network-layer misconfig | Raw ip:port |
dos, fuzz, and intrusive templates and info severity are excluded by default.
Overview
Knowing which hosts you expose is the first half of the problem. The second half is
whether any of them can be used against you. An ASN can announce thousands of addresses,
and the ones that matter are rarely the ones on the asset list. They are the forgotten
staging server, the appliance shipped with a default page, the service that was patched
everywhere except the range nobody claims.
This workflow takes ASNs and returns findings, not just an inventory. It resolves the
announced ranges through RIPEstat, port-scans them across the fleet, and runs three
nuclei branches: known CVEs, exposures covering misconfiguration and
default logins and takeover, and network templates against the raw ports. Destructive
template classes are excluded, so this is a scan you can point at production. Output is a
downloadable PDF carrying the findings, the hosts scanned, and the methodology.
Point it at your own ranges for exposure management, or
at a target's ranges before a deal closes. Scheduled, it becomes regression testing for
your perimeter, catching the service that reappears after a rollback.
One limit worth knowing: ASN resolution is capped at 100 prefixes per run. For an
organization announcing more than that, split the ASN list across runs.
Pipeline
Read the targets, one per line. An ASN such as AS13335, an IP, or a CIDR. IPs and
CIDRs pass straight through.
Targets to IP prefixes resolves each ASN to its announced ranges through RIPEstat,
capped at 100 prefixes.
mapcidr turns those prefixes into scannable ranges.
rustscan port-scans them. The scan is distributed, so resolved
ranges fan out across the fleet and every prefix is scanned in parallel. Results are
parsed into ip:port pairs.
The pipeline forks here. httpx probes the pairs and keeps the ones
answering as web servers, and their URLs feed two nuclei branches:
CVE templates, and exposure templates covering misconfiguration, default logins and
takeover.
In parallel, a third nuclei branch runs network templates against the
raw ip:port pairs, so services that are not web servers are still tested.
All three branches, plus the live-host list, collect into one downloadable PDF with the
findings, the hosts scanned, and the methodology.
dos, fuzz and intrusive templates are excluded, as are info-severity results.
Inputs
Targets. One entry per line. An ASN such as AS13335 resolves to its announced
ranges, while an IP or a CIDR passes straight through, so a single run can mix all
three.
Prefix cap. ASN resolution stops at 100 announced prefixes per run. That ceiling
ships on, and it is what stops one large ASN from turning a run into an open-ended
scan. For an organization announcing more, split the ASN list across runs.
Template exclusions.dos, fuzz and intrusive template classes are off by
default and info-severity results are dropped. Both defaults are what make this a scan
you can point at production.
Outputs
A PDF report. One downloadable file carrying the findings, the hosts scanned, and
the methodology behind them.
A live host inventory. The ip:port pairs the port scan found, plus the subset
that answered as web servers with their titles, server banners and detected tech.
Three finding sets. CVE matches, exposure matches covering misconfiguration and
default logins and takeover, and network-template matches against the raw ports. Each
carries the template that fired, the severity, and the address it matched on.
Sample output
From a completed run against scanme.nmap.org, the host Nmap publishes for this purpose.
httpx keeps the addresses that answer, with what is serving them:
url
status_code
title
webserver
tech
template
severity
target
kind
http://45.33.32.156:80
200
Go ahead and ScanMe!
Apache/2.4.7 (Ubuntu)
Apache HTTP Server:2.4.7, Ubuntu
null
null
null
null
null
null
null
null
null
CVE-2023-48795
medium
45.33.32.156:22
cve
null
null
null
null
null
apache-mod-negotiation-listing
low
http://45.33.32.156:80/index
exposure
null
null
null
null
null
ssh-weak-algo-supported
medium
45.33.32.156:22
exposure
null
null
null
null
null
ssh-diffie-hellman-logjam
low
45.33.32.156:22
exposure
null
null
null
null
null
ssh-cbc-mode-ciphers
low
45.33.32.156:22
exposure
null
null
null
null
null
ssh-weak-mac-algo
low
45.33.32.156:22
exposure
The CVE pass reports the template, the severity, and where it matched:
CVE-2023-48795 medium 45.33.32.156:22
The exposure pass covers configuration rather than known CVEs:
One address answered on the web, and the findings that came back are on the SSH
service beside it. That is the argument for scanning the range rather than the
asset list.
FAQ
Can I run this against an ASN I do not own?
The resolution step only reads public routing data, so mapping an ASN to its announced
prefixes needs no permission from anyone. Everything after it is active traffic against
hosts in those ranges, so run the scan itself only where you have authorization.
How is this different from running nuclei myself?
nuclei needs a target list, and building that list is most of the work
here. This goes from an ASN to announced prefixes to open ports to live web servers, then
runs three template sets in parallel across the fleet. The command you would have typed
is step five onward.
What does a run cost?
Scope drives it. Runtime tracks the number of announced prefixes and open ports, not the
number of ASNs you paste in, because the port scan is distributed and every prefix is
handled at the same time. The 100-prefix cap is the ceiling on a single run.
Is it safe to point at production?
The template classes that knock services over are excluded, which is the difference
between this and an unfiltered nuclei run. It is still a port scan
followed by active probing, so treat it the way you would any authenticated scanner
window.
What does running it on a schedule buy?
A diff. The staging box that came back after a rollback, the appliance somebody racked
last week, the range that arrived with an acquisition. Compare one run against the last
and the change is the finding.
Related workflows
Find Exposed Databases. Reach for this instead
when you already have the netblock and only want the data stores, checked across eight
engines for anonymous access rather than swept for CVEs.
Passive Port & CVE Scan (Shodan). Reach for this
instead when you cannot scan the range yourself and need the same port and version
picture out of somebody else's packets.
Attack Surface Discovery by Company Name.
Reach for this instead when you do not know which ASNs belong to the company yet and
are starting from the legal name.