Recon
Match a BIG-IP management URL to its release
Fingerprint the software version of a remote F5 BIG-IP management interface.
overview
What bigip-scanner does
Slot bigip-scanner after a port or service scan flags an F5 management URL. It stops at version ID; discovery and CVE exploit steps stay elsewhere in the graph.
Run it when you already know the host is BIG-IP and need the exact release before picking nuclei templates or manual checks. Without -v, there is no fingerprint table to match against.
Inputs are -t for the management URL and -v for the version table. Outputs are a file and folder. Prefer this over httpx or fingerprintx when you need a release string, not a generic tech hint.
use cases
Where bigip-scanner fits
Pin down a BIG-IP release before testing
Fingerprint the management interface so you know the exact version, then map it to known CVEs instead of firing every exploit blindly.
Triage exposed F5 edge devices
Across an estate of edge appliances, version each BIG-IP interface to find which ones run releases with public, unpatched vulnerabilities.
Confirm a service after a port scan
Feed a host flagged as F5 by a port or service scan into bigip-scanner to confirm the appliance and capture its precise version.
Track patching with a custom version table
Supply your own version table so the scanner recognizes the releases in your environment and reports drift as devices get patched.
reference
bigip-scanner inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| target | STRING | -t | Target URL of the BIG-IP management interface. |
| version-table | FILE | -v | Version table mapping resource fingerprints to releases. |
| all | BOOLEAN | -a | Request all resources instead of stopping at the first exact match. |
| debug | BOOLEAN | -d | Debug mode, showing the requests and responses used to fingerprint. |
Showing key inputs. bigip-scanner exposes 4 inputs in total.
example
Run bigip-scanner
# fingerprint a BIG-IP management URL against the version tablebigip-scanner -t https://bigip.example.com -v version-table.txt[*] Target: https://bigip.example.com[*] Loading version table[*] Probing management resources[+] Exact match: BIG-IP 15.1.5 Build 0.0.1[*] Host: bigip.example.com[*] Interface: https://bigip.example.com[+] Version written for downstream CVE mappingguidance
Choosing bigip-scanner
Use bigip-scanner once a port scan or fingerprinter such as naabu or fingerprintx has already flagged an F5 BIG-IP management interface. It versions a known appliance; it does not find hosts.
fingerprintx
General service fingerprinter across many protocols. bigip-scanner is built only for F5 BIG-IP releases.
nuclei
Runs CVE templates once you know the version. bigip-scanner supplies that version string.
httpx
Detects tech and titles broadly. bigip-scanner pins the exact BIG-IP release a broad prober only hints at.
faq
bigip-scanner questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run bigip-scanner yourself
A host is probed by httpx to confirm a live F5 interface, then bigip-scanner fingerprints its release and writes the detected version as a queryable output.
Facts on this page come from the live Trickest tool library.