Network scanning
Probe hosts and IP ranges for exposed services, weak TLS and missing security headers.
Overview
The Network engine checks your hosts and IP ranges for exposed services and weak transport security.
Cloud scans probe over HTTP(S); for raw TCP/UDP port sweeps and service fingerprinting, the job is handed to a self-hosted runner.
How it works
From the cloud, SecNxt probes common service ports, evaluates certificate expiry, flags missing security headers and version disclosure.
With a self-hosted runner enabled, deep scans run full port sweeps (nmap/naabu-style) that the cloud cannot perform alone.
How to use it
- 1Open a project and choose Network.
- 2Add one or more targets (host, IP or CIDR).
- 3Toggle 'self-hosted runner' for deep raw-port scans, then run.
When to use it
- External attack-surface checks.
- Spotting accidentally exposed admin ports.
Tips & best practices
- Only scan assets you are authorised to test.
FAQ
- Why do deep scans need a runner?
- Raw sockets aren't available in the cloud runtime; a runner on your network performs the real port scan.