Service Scan
service_scanFingerprint services on target hosts by scanning specified ports with nmap version detection and safe default NSE scripts, falling back to common web ports when none are provided.
Instructions
[AGGRESSIVE — requires human approval] Fingerprint services on specific ports with nmap -sV plus safe NSE scripts.
scripts is restricted to default/discovery/version/banner. Exploit, dos,
brute, malware, intrusive, and safe-as-a-category are refused: the safe
category pulls broadcast-* scripts (which crash nmap with the
nse_nsock.cc:342 assertion and probe the LAN instead of the target) and
http-slowloris-check (which holds connections open and stalls the whole
scan at the engagement's rate limit). default is the curated category
that fingerprints without either failure mode.
ports defaults to what port_scan already discovered for the
requested hosts (the open_port assets in the store) and falls back to the
web ports 80,443 only when nothing was discovered. target may name
several hosts — the service phase feeds it every host that has an
open_port asset, so one nmap pass fingerprints the whole estate instead of
the single focus host. The old design scanned one host's 80,443 and
silently reported "no services" on every estate that runs on 3000/8080/
8443 — exactly the ports port_scan exists to find. The chain is
ports -> services; services must consume what ports produced.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ports | No | ||
| target | Yes | ||
| scripts | No | default |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||