Rapid7 Introduces Credentialed Pre-Port Discovery to Enhance Network Scanning
Rapid7's new credentialed pre-port discovery feature allows scan engines to query hosts directly for open ports, bypassing firewall limitations and improving scan accuracy.
Traditional network scanning relies on external probing to determine which ports are open on a host. This method involves sending traffic to a range of ports and inferring their status based on the host's responses or lack thereof. While effective in many scenarios, this approach faces challenges with hardened systems that may not respond to probes, network devices like firewalls that block traffic, and intrusion prevention systems that can throttle scanning activity. These limitations can lead to incomplete scan results, increased scan times due to timeouts, and a less accurate understanding of the host's attack surface.
To address these issues, Rapid7 has introduced a new feature called credentialed pre-port discovery, available in version 8.58 of its scanning solutions. This innovative approach leverages existing credentials that the scan engine already possesses for authenticated access to a host. Instead of probing from the outside, the scan engine authenticates to the host using these credentials and directly asks the operating system which ports are currently listening for incoming connections. This method provides an authoritative list of open TCP and UDP ports directly from the source, eliminating the need for inference.
The primary benefit of credentialed pre-port discovery is its ability to bypass network-level restrictions. Ports that might be hidden from external probes due to firewall rules or other network controls can still be identified because the scan engine is querying the host directly. This leads to more accurate and comprehensive discovery of open ports, even on systems with strict network segmentation or security policies. Furthermore, by replacing lengthy probing processes with a direct query, the efficiency of the initial discovery phase is significantly improved, potentially reducing overall scan times.
However, this new method introduces a trade-off. While the host provides an accurate list of its listening ports, it has no visibility into the network path between itself and the scan engine. If a firewall or other network control prevents the scan engine from reaching a port that the host reports as open, the engine will still attempt to connect. This can lead to connection timeouts for unreachable ports, extending the scan duration for that specific host. In cases of excessive connection failures, the scan might even terminate early, reporting host scan termination due to connection errors, even though the host itself was responsive to the initial credentialed query.
Enabling credentialed pre-port discovery requires careful consideration. It is most beneficial in environments where the scan engine has broad network reachability to the target hosts and where authenticated scanning using SSH, Scan Assistant, or Windows credentials is already in place. The feature is particularly advantageous for hardened or rate-limited hosts, as well as for scanning large port ranges where traditional methods are slow or unreliable. The option is available as a per-template checkbox within the Asset Discovery settings and is disabled by default.
When multiple credentials are configured for a host, Rapid7's engine prioritizes them in a specific order: Scan Assistant, then SSH, followed by direct Windows connections. The first credential that successfully authenticates is used for the pre-port discovery query. If no matching credential is found or if authentication fails, the system automatically falls back to the traditional network port scan without reporting an error, ensuring that no host is left un-scanned.
Rapid7 emphasizes that while this feature enhances discovery, subsequent steps like service fingerprinting, vulnerability checking, and policy evaluation remain unchanged. Administrators are advised to consult the configuration and troubleshooting documentation for detailed guidance on enabling and managing this feature, including understanding potential reachability issues and how to test them. The goal is to provide a more accurate and efficient initial discovery phase, laying a stronger foundation for subsequent security assessments.