ServicesPorts, services and CVEs
What's answering on your IP addresses?
An exposed database or an open remote desktop service is one of the shortest routes into a company. Nulink scans the top 1,000 TCP ports on every host it discovers, fingerprints the software and version behind each open port, cross-checks the result against what the internet cache already publishes about you, and matches detected versions against CVEs in the US National Vulnerability Database. Each match comes with its severity and a link to the advisory, so your team can judge it instead of trusting a score.
What it finds
- Open ports among the top 1,000 TCP ports on every discovered host
- The service, software and version behind each open port
- Exposed databases, caches, message queues and object stores
- Remote access services such as SSH, RDP and VNC reachable from anywhere in the world
- Detected versions matched to CVEs in the National Vulnerability Database, with severity and advisory links
- What the internet cache already records about your hosts, cross-checked against our own scan
- Ports that were not open the last time we looked
Where the data comes from
- Nulink port scanning
- Service and version fingerprinting
- OSINT sources
- NVD (NIST)
How it works
- 01
Scan
Every discovered host is probed across the top 1,000 TCP ports for services that answer.
- 02
Fingerprint
Nulink identifies the software and version behind each open port from how it responds.
- 03
Match
Detected versions are checked against the National Vulnerability Database, and against the internet cache's record of the same host.
- 04
Prioritise
Services that should never have been public are ranked ahead of the ones that merely need an upgrade.
In detail
- Two views of the same host
- Nulink scans your hosts directly and also reads what the internet cache already publishes about them. Where the two agree you have confirmation. Where they disagree you have learned something: a port the internet cache has on record that you believed was closed, or a service answering us that nothing else has indexed yet.
- Versions first, then advisories
- Version detection is matched against the US National Vulnerability Database. Every match carries its CVE identifier, severity and a link to the advisory itself, because a security team deciding what to patch this week needs the source, not a number.
- The top 1,000 ports, deliberately
- Scanning all 65,535 ports on every host on every run is slow, noisy and mostly empty. The top 1,000 TCP ports are where real services run and where attackers look first. We would rather scan that set often than scan everything rarely.
- Matching is not exploitation
- A CVE match means the version you are running is the version named in the advisory. It is not proof of exploitability, and a back-ported patch can leave a version string that still looks vulnerable. The evidence on the finding shows exactly what was detected, so your team can check against their own patch records in a minute.
What changes for your team
Close the obvious doors
Exposed data stores and open remote access are the first things anyone tries, and the fastest things to fix.
Patch with a reason
Know which internet-facing software has a CVE against it rather than upgrading on general principle.
Catch changes
A port that opens overnight shows up as a change, with the date it appeared.
Especially useful for HealthTech.
What it doesn't do
Every tool has edges. Knowing where ours are is the difference between a control you can rely on and one you only think you have.
- Coverage is the top 1,000 TCP ports per host. A service deliberately parked on an unusual high port can be missed.
- Scanning is TCP. UDP services are not covered.
- Vulnerability findings come from matching detected versions against public advisories. Nulink does not attempt exploitation, so a match is a strong signal rather than a confirmed compromise.
Questions about Ports, services and CVEs
Will the port scan set off our monitoring?
Quite possibly, and that is worth knowing in itself. It is an ordinary port scan from our infrastructure, not an attack, but tell your SOC it is coming so the first run does not become an incident. Get in touch if you need our source addresses to allowlist.
What about UDP, or ports above the top 1,000?
Not covered today. The trade is deliberate: frequent scans of the ports services actually use, rather than occasional scans of all 65,535. If you run something important on an unusual port, tell us and we will factor it in.
How do you avoid flagging software we have already patched?
We show the detection. Each finding carries the version string or response that produced the match, so when a back-ported patch leaves an old-looking version in place your team can confirm it in seconds and mark the finding reviewed.
Web exposure checks
WebCheck the headers, cookies, CORS policies and technology stack in front of every site you run.
Read more
DNS and email security
EmailCheck SPF, DMARC, DKIM and MX on every domain, including the ones you forgot you own.
Read more
Credential and secret exposure
LeaksFind staff credentials in breach data and API keys left behind in archived pages.
Read more
Visibility is security. Start with yours.
Book a 30-minute walkthrough with the team, or connect your first account and see results today.