Does this take a host list?

No. The input is `port-details` from scan for open ports. If you have raw hosts, run the open-port scan first.

Is open 22 the same as SSH?

No. Open 22 is a hint. This module speaks the protocol and returns `protocol`, `banner`, and `products` so you know what is actually listening.

What is the difference between banner and fingerprint?

A banner is what the service advertises on connect. A fingerprint is what the module concludes from the banner and the handshake. A service can lie in its banner; the fingerprint is the module's call.

Can I skip this and go straight to weak credentials?

No. Weak credentials takes `network-service-details`, not raw `port-details`. You cannot test logins on a port number. You need the named service.

Is this a port scanner or a host scanner?

Neither. It takes `port-details` from the open-port scan and names the service on each port. It does not discover hosts and it does not discover ports. If you still have a host list, run the open-port scan first.

How does service fingerprinting differ from a full network scanner?

A general-purpose network scanner scans, fingerprints, and OS-detects in one binary. This is only the fingerprint step, as a nestable file face: port records in, named services out. The scan and the OS-detect steps live on other modules.

2026-08-13

Attack Surface Management

Fingerprint Network Services

Identify the service on each open port. Service fingerprinting returns protocol, banner, product, and version for misconfig and credential tests.

What Fingerprint Network Services does

Service fingerprinting turns an open port into a named service. Once you know which ports answer, the next question is what is actually listening on them: the protocol, the banner, the product, and the version. This module speaks each protocol and returns a typed record that downstream misconfig and credential scans nest on.

You feed port-details, not a host list. The module speaks the protocol on each open port and writes protocol, banner, product, version, TLS, and transport as network-service-details. Open 22 is not SSH until this step says so. Weak-credential testing cannot skip this face.

Where it fits in the pipeline

Illustrative excerpt. Each node is a Trickest module.

Upstream

Scan for open ports is the producer of port-details. This module does not scan hosts.

Downstream

Scan network services for misconfigurations can consume enriched records here, or skip this hop and take raw port-details. Scan network services for weak credentials must consume network-service-details. Findings from those scans feed the scan report.

Parallel

None on this input. Probe live HTTP(S) runs on hosts, not port-details. Identify CMS, CDN, and WAF runs on live web URLs. Do not cross into the web tail.

Network tail (this page is the middle hop): hosts -> open-ports -> network FP -> (misconfig | weak-creds). Never hosts -> probe-web -> web FP.

When to use this

Nest this after scan for open ports has produced port-details, and before any weak-credential test. Misconfig can take raw port records and skip this step. Weak credentials cannot. If you still have a host list, you are one hop too early.

Inputs and outputs

Required: port-details (FILE): JSONL port-discovery records from scan for open
Outputs: network-service-details: JSONL records (ip_address, port, protocol,

Data

The tables this module produces. Sample rows are illustrative.

network-service-details9 columns · 3 sample rows

Named service on each open port: protocol, banner, product, version, TLS, and transport.

	ip_addresstext	portint	protocoltext	transporttext	tlsbool	bannertext	productsjson	versiontext	hostnametext
1	203.0.113.10	22	ssh	tcp	false	SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.4	Array[1]	8.9p1	host1.example.com
2	203.0.113.10	443	https	tcp	true	HTTP/1.1 200	Array[1]	1.18.0	host1.example.com
3	198.51.100.25	80	http	tcp	false	Apache/2.4.52 (Ubuntu)	Array[1]	2.4.52	host2.example.com

How it differs from similar modules

Scan for open ports

Artifact class it owns

Which TCP ports answer

Upstream it needs

hosts

Fingerprint Network Services

Artifact class it owns

Protocol, banner, product on each open port

Upstream it needs

port-details

Scan network services for misconfigurations

Artifact class it owns

Setup issues on named (or raw) services

Upstream it needs

port-details (FP optional)

Scan network services for weak credentials

Artifact class it owns

Vendor/default/weak logins on five protocols

Upstream it needs

network-service-details (FP required)

Identify CMS, CDN, and WAF is the web-tail fingerprint. Different input, different tail.

questions