loading
Loading content
loading
Attack Surface Management
Scan hostnames, IPs, and ranges for the top 1000 TCP ports. Set include and exclude ports and a per-host open-port threshold. Output feeds network service fingerprinting.
Before you can fingerprint a service, you need to know which ports are open. This module scans the top 1000 most common TCP ports on every IP behind every hostname, drops hosts that exceed your open-port threshold, and emits typed port records ready for the fingerprint step. It is the network-tail entry: hosts go in, port-details come out.
You feed hostnames, IPs, or CIDR ranges. The module scans which TCP ports
answer on every IP behind every hostname, using the top 1000 frequency set
unless you pass ports. Hosts over port-threshold (default 10) are dropped
entirely. You get port-details for the fingerprint step, plus flat
hostname-ports and ip-ports.
Hostname enumerators (OSINT, crawl, DNS permutations, root-domain
DNS brute force, recursive DNS brute force) produce hosts. DNS records can
feed the same list.
Fingerprint network services consumes port-details.
Misconfig can take those raw records. Weak credentials cannot; it needs
network-service-details from fingerprinting first. Findings from those
scans feed the scan report.
Probe live HTTP(S) runs on the same hosts and answers
HTTP liveness, not open TCP ports. Do not cross into the web tail.
Network tail (this page is the first hop): hosts -> open-ports -> network FP -> (misconfig | weak-creds). Never hosts -> probe-web -> web FP.
Nest this after you have a host list from DNS or OSINT, and before anything that needs to know which TCP ports answer. Fingerprinting, misconfig, and weak-credential testing all sit downstream of that record. If you only care whether HTTP is live, that is a different tail.
hosts (FILE): hostnames, IP addresses, or IP ranges, one per line.
ports (STRING): comma-separated ports to include. Omit this and the scan
exclude-ports (STRING): comma-separated ports to skip.
port-threshold (STRING): exclude hosts with more than this many open
port-details: JSONL records (ip_address, port, hostname when known).
hostname-ports: hostname:port lines.
ip-ports: ip_address:port lines.
The tables this module produces. Sample rows are illustrative.
JSONL records of open TCP ports. This is the input the fingerprint step consumes.
ip_addresstext | portint | hostnametext | |
|---|---|---|---|
| 1 | 203.0.113.10 | 22 | ssh.example.com |
| 2 | 203.0.113.10 | 443 | ssh.example.com |
| 3 | 198.51.100.42 | 8080 | NULL |
Flat list of open ports formatted as hostname:port.
host_porttext | |
|---|---|
| 1 | ssh.example.com:22 |
| 2 | ssh.example.com:443 |
| 3 | web.example.com:8080 |
Flat list of open ports formatted as ip_address:port.
ip_porttext | |
|---|---|
| 1 | 203.0.113.10:22 |
| 2 | 203.0.113.10:443 |
| 3 | 198.51.100.42:8080 |
Scan for Open Ports
Artifact class it owns
Which TCP ports answer
Upstream it needs
hosts
Artifact class it owns
Protocol, banner, product on each open port
Upstream it needs
port-details
Artifact class it owns
Setup issues on named (or raw) services
Upstream it needs
port-details (FP optional)
Artifact class it owns
Vendor/default/weak logins on five protocols
Upstream it needs
network-service-details (FP required)
Probe live HTTP(S) is the web-tail entry on the same hosts. It does not emit port records.
questions
port-scan instrument; this page owns the nestable job
Drop this module into a Trickest workflow and connect it to your upstream and downstream nodes. The face contract above is the wiring.
Get a personalized demo
A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.