loading
Loading content
loading
Vulnerability Scanning
Probe listening services from open-port records for information disclosure, exposed functionality, and takeover. Runs on port-details, rate-limited.
Network service misconfigurations are setup issues on listening services that leak information, expose sensitive functionality, or hand over the asset. This module probes services from open-port records for those config issues, and it can run straight from the open-port scan without a fingerprint step. It is the network-tail config audit, not a web-app scan.
You probe listening network services for setup issues on named or raw port
records: information disclosure, exposed functionality, and takeover. You can
nest this on port-details from the open-port scan and skip fingerprinting.
This is not credential testing and not a web-app misconfig scan.
Scan for open ports produces raw port-details. Fingerprint
network services can enrich those records first. Either feed works.
findings feed the scan report.
Scan network services for weak credentials runs on the same
network tail but needs network-service-details and tests logins, not
config. Do not cross into the web tail. Web setup issues belong on scan for
misconfigured software (a URL list).
Network tail (this page is one of the two last hops): hosts -> open-ports -> network FP -> (misconfig | weak-creds). Fingerprinting is optional for this
hop. Never hosts -> probe-web -> web FP.
Nest this after you have open ports. Raw port-details is enough, so you can
go straight from the open-port scan. Fingerprinting still helps you read the
rows, but it is not required here. If you wanted to test logins, that is the
weak-credentials sibling, and that one cannot skip fingerprinting.
port-details (FILE): JSONL records of port or network-service discovery
rate-limit (STRING): maximum requests per second per machine. Default 300.
findings: JSONL records (finding, location, severity, ip_address,
The tables this module produces. Sample rows are illustrative.
Configuration issues on listening network services (information disclosure, exposed functionality, takeover).
findingtext | locationurl | severitytext | ip_addresstext | hostnametext | domain_nametext | descriptiontext | |
|---|---|---|---|---|---|---|---|
| 1 | FTP Anonymous Login | ftp://203.0.113.10:21 | medium | 203.0.113.10 | ftp.example.com | example.com | FTP service allows anonymous login without a password. |
| 2 | SSH Password-based Authentication | ssh://203.0.113.10:22 | low | 203.0.113.10 | ssh.example.com | example.com | SSH accepts password-based authentication; keyboard-interactive is enabled. |
| 3 | Redis Exposed Without Auth | redis://198.51.100.42:6379 | high | 198.51.100.42 | cache.example.com | example.com | Redis answers commands with no AUTH required. |
Artifact class it owns
Protocol, banner, product on each open port
Upstream it needs
port-details
Scan Network Services for Misconfigurations
Artifact class it owns
Setup issues on named (or raw) services
Upstream it needs
port-details (FP optional)
Artifact class it owns
Vendor/default/weak logins on five protocols
Upstream it needs
network-service-details (FP required)
Scan for misconfigured software is the web twin: setup issues on a URL list, not network services on port-details.
questions
Drop this module into a Trickest workflow and connect it to your upstream and downstream nodes. The face contract above is the wiring.
Get a personalized demo
A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.