Network mapping using a fingerprint
A system for network mapping includes an interface and a processor. The interface is configured to receive an indication to scan a set of addresses using a fingerprint. The processor is configured to for an address of the set of addresses: receive a response associated with the address; determine whether the response matches the fingerprint; and store the address in a client network database in the event the response matches the fingerprint.
1. A system for network mapping Internet connected assets belonging to a client network to identify security vulnerabilities, comprising:
an interface configured to:
receive an indication to scan a set of addresses comprising Internet addresses using a fingerprint, the fingerprint comprising a fingerprint criterion type comprising a set of open ports criterion type including a set of port numbers associated with open ports and an encryption certificate criterion type; and
a hardware processor configured to:
for an address of the set of addresses:
receive a response to said scan, said response associated with the address and comprising a set of open ports associated with the address and an encryption certificate;
fingerprint the address of the set of addresses by determining whether the set of open ports associated with the address matches the set of open ports associated with the fingerprint criterion type and determining whether the encryption certificate matches the encryption certificate criterion type;
determine that said Internet connected assets associated with the address are part of the client network when the response matches the fingerprint;
update a client network database with said address to include said Internet connected assets associated with the address as part of the client network; and
use said client network database to identify said security vulnerabilities in connection with said Internet connected assets belonging to said client network.
2. The system of claim 1 , wherein the set of addresses comprises all Internet addresses.
3. The system of claim 1 , wherein the set of addresses comprises a predetermined subset of addresses.
4. The system of claim 1 , wherein the hardware processor is further to:
for the address of the set of addresses:
request the response, wherein the response is associated with the address of the set of addresses.
5. The system of claim 4 , wherein requesting the response comprises requesting the response from a network information database.
6. The system of claim 5 , wherein responses stored in the network information database comprise responses compiled by scanning the Internet.
7. The system of claim 6 , wherein scanning the Internet comprises providing a payload to a set of Internet addresses.
8. The system of claim 4 , wherein requesting the response comprises requesting the response from the address.
9. The system of claim 8 , wherein requesting the response from the address comprises providing a payload to the address.
10. The system of claim 1 , wherein the fingerprint is associated with the client network.
11. A method for network mapping Internet connected assets belonging to a client network to identify security vulnerabilities, comprising:
receiving an indication to scan a set of addresses comprising Internet addresses using a fingerprint, the fingerprint comprising a fingerprint criterion type comprising a set of open ports criterion type including a set of port numbers associated with open ports and an encryption certificate criterion type; and
for an address of the set of addresses:
receiving, using a hardware processor, a response to said scan, said response associated with the address and comprising a set of open ports associated with the address and an encryption certificate;
fingerprinting the address of the set of addresses by determining whether the set of open ports associated with the address matches the set of open ports associated with the fingerprint criterion type and determining whether the encryption certificate matches the encryption certificate criterion type; and
determining that said Internet connected assets associated with the address are part of the client network when the response matches the fingerprint;
updating a client network database with said address to include said Internet connected assets associated with the address as part of the client network;
using said client network database to identify said security vulnerabilities in connection with said Internet connected assets belonging to said client network.