subfinder lists hosts. probe-2375 and probe-2376 check ports 2375 and 2376 and read /version. containers reads the container list. report writes the findings.
The check does not create or exec containers.
Results
findings.jsonl on the report node. One row per exposed daemon, plus a summary count.
Target
Put a domain on subfinder. The probe checks at most 50 hosts from that enumeration.
Overview
An open Docker Engine API is a host you can control, not a banner you file away. Port 2375 speaks plain HTTP. Port 2376 speaks TLS. This workflow enumerates hosts in a domain with subfinder, then asks each host for /version on ports 2375 and 2376. A body that is Docker version JSON is an exposed daemon. Those hosts are then asked for the container list. The check does not create a container, pull an image, or run a command. Point it at a domain you are authorised to test, and treat a hit as an exposure ticket for exposure management.
Pipeline
subfinder enumerates hosts for the domain you set.
probe-2375 and probe-2376 read /version on ports 2375 and 2376, on at most 50 hosts. A hit requires Docker version JSON.
containers reads /containers/json only for hosts that confirmed an engine. It does not create or exec a container.
report writes findings.jsonl, one row per exposed daemon, plus a summary count.
Inputs
Domain. Set on the subfinder node. Hosts come from that enumeration. There is no built-in live target.
Outputs
findings.jsonl. One JSON line per exposed daemon, plus a summary of hosts scanned and how many answered.
Integrations
Subfinder. Host enumeration for the domain.
Sample output
The line below is the summary from a completed run on brokencrystals.com on 2026-09-24. Fifty hosts were scanned. None exposed a Docker Engine API.
kind
hosts_scanned
docker_exposed
rce_surface
scanned_at
summary
50
0
0
2026-09-24T10:16:11Z
FAQ
What counts as exposed?
A host that accepts a connection on 2375 or 2376 and returns Docker version JSON from /version.
Does this start a container?
No. The probes read /version, and containers reads the container list on a confirmed engine. Nothing is created or executed.
How many hosts are checked?
At most 50 hosts from the subfinder output.
Where should I run it?
On a domain you are authorised to test. An exposed daemon is an exposure finding.
Related workflows
Exposed Database Scanner. Reach for this when the open port is a database engine rather than the Docker API.
Cloud Bucket Finder. Reach for this when the exposure is an object-storage bucket rather than a daemon on the host.