Blackbox Asset Management: Discovering and Identifying IT Infrastructure Without Direct Access
Security Vision expert Fedor Bokov explains how organizations can manage IT assets in blackbox mode when customers refuse to provide credentials or internal documentation. The approach begins with network scanning using tools such as nmap and masscan to detect live hosts and open ports across external and internal perimeters. Identification relies on banner grabbing, HTTP header analysis, favicon inspection, HTML structure, and service fingerprinting to determine exact software versions and operating systems. Examples include extracting Ubuntu 22.04 LTS details from an OpenSSH banner and identifying Checkpoint Gaia from specific HTTP responses on port 443. Further analysis of ports like 1433 and 443 reveals Microsoft SQL Server 2017, nginx 1.28.0, PHP 8.2.29, and Bitrix-Site-Manager instances. The methodology concludes with continuous monitoring cycles that track version changes, new services, and configuration deviations to prioritize vulnerability remediation without traditional inventory access.
HabrSep 24, 2026Translated from Russian