Full Network Port & Service Assessment

Overview

Knowing what your network exposes means starting from whatever you happen to have, a domain, an ASN, or a raw CIDR, and ending with a straight answer: which hosts have dangerous services open to the internet. This workflow takes one input of any of those types, resolves it to the addresses worth scanning, and guards the blast radius so a single cloud ASN cannot turn into a million-host sweep. It then port-scans the range across the fleet, fingerprints the web services it finds, checks the rest for known service issues, and grades each host A to F by the worst thing it exposes. What comes back is a ranked exposure report rather than a wall of open ports, which is what makes it usable for exposure management rather than just another scan. It is token-free and safe by default.

Pipeline

1. Read the input: a domain, an ASN, or a CIDR, one per line.
2. Normalize it to addresses. An ASN becomes its announced prefixes, a hostname resolves to its A records over DNS-over-HTTPS, and the blast radius is guarded: any block larger than a /16 is skipped and the target list is capped, so a cloud ASN cannot explode the scan.
3. mapcidr expands the CIDRs to individual hosts, and rustscan sweeps their ports, sharded across the fleet.
4. The open ports are normalized to ip:port, then httpx fingerprints the web services and nuclei runs its network service checks against the rest.
5. Each host is graded A to F by the most dangerous service it exposes, and the ranked result is written to a report.

Inputs

• Target. One domain, ASN, or CIDR per line. Point it at scope you are authorised to scan.

Outputs

• Per-host exposure. For each host: its open ports, the dangerous ones (database, remote-access or plaintext services), and a letter grade for how exposed it is.
• Overall grade. The worst host's grade taken as the assessment's headline, with the count of hosts exposing a dangerous service.
• Report. The graded hosts and their services in one file, sorted so the worst exposure is first.

Sample output

Illustrative, in the record shape the workflow emits. Real runs name live IPs, so the hosts here are TEST-NET documentation addresses.

Each host is graded by its most dangerous open port, worst first:

The assessment summary is the headline grade in one line:

{"hosts": 42, "open_ports": 118, "dangerous_hosts": 3, "overall_grade": "F"}

FAQ

What can I give it as a target?

One input of any of three kinds: a domain, an ASN (as AS13335 or 13335), or a CIDR. It works out which it is and resolves each to the addresses to scan, so you do not pre-expand anything yourself.

How does it avoid scanning half the internet?

The normalize step guards the blast radius. It skips any block larger than a /16, caps the total target list, and falls back to a reserved address if a target resolves to nothing. Expanding a large cloud ASN therefore cannot turn into an unbounded scan.

What does the A to F grade mean?

Each host is graded by the most dangerous service it leaves open. A database, remote-access or plaintext protocol exposed to the internet is the worst case and drives the grade down; a host with only a hardened web port grades well. The assessment's overall grade is the worst host in the set.

Does it need credentials or an API key?

No. ASN lookups use a public prefix API, hostnames resolve over DNS-over-HTTPS, and the scan itself needs no account. The whole run is token-free.

Related workflows

• ASN-Wide Vulnerability Scan. Reach for this when you want CVEs and misconfigurations across an ASN's web surface rather than a port-and-service exposure grade.
• Find Exposed Databases. Reach for this when you specifically want databases left open, checked and confirmed, rather than every port graded.