devto 2026-09-24 원문 보기 ↗
Internet-wide scanners are a double-edged tool. Attackers use them to find exposed systems; defenders can use the same capability to discover what they have accidentally exposed. In 2026, government advisories have repeatedly pointed to scanning services as part of the attacker's workflow, which makes the defensive use of the same data both practical and urgent. This article explains how to turn ZoomEye measurement into a self-assessment routine.
Most organizations do not have a complete, current picture of what is reachable from the internet. Assets are added by different teams, exposed temporarily for a project, and forgotten. Attackers do not rely on the organization's inventory; they rely on the internet's actual state. The gap between the two is where breaches begin. In the August 2026 advisory on Siemens S7 PLCs, the scanning step was explicit: attackers used services like Censys and ZoomEye to find exposed controllers before generating exploits.
The approach is straightforward. For each technology an organization runs, construct a fingerprint query and check whether any of its own assets appear. The counts below, collected with ZoomEye on 2026-09-19 (sub_type "all", pagesize one), illustrate the scale of common technologies and give a sense of which fingerprints return meaningful results.
app="nginx" returned 309,196,565 matches and app="Apache" returned 594,958,906, showing how ubiquitous web servers are.app="WordPress" returned 7,881,967 and app="Exchange" returned 2,357,417, two of the most commonly exposed application platforms.app="VMware" returned 1,423,789 and app="Fortinet" returned 4,523,889, reflecting large virtualization and network-security footprints.app="MongoDB" returned 680,348, a database that should rarely be internet-facing.
These figures are global totals, not an organization's own exposure. Their value is as a reference point: they show that the technologies most organizations run are also the technologies most present on the open internet, which means accidental exposure is common.The self-assessment workflow has four steps. First, enumerate the technologies the organization runs and the fingerprints that identify them. Second, run scoped queries and compare the results to the internal asset inventory. Third, investigate every match that the inventory does not explain. Fourth, remediate by removing unnecessary exposure and patching what must remain public.
The most valuable output of this process is the unexpected match: a service that appears in an external scan but not in the inventory. That is an unknown exposure, and it is exactly the kind of asset attackers find first. Treating each unexpected match as a finding, rather than dismissing it as a false positive, is what makes the routine effective.