Kubernetes control plane & kubelet
// tool: probe_public_k8sAn anonymous API server lets an attacker read every secret in the cluster. An anonymous kubelet lets them run commands in your pods. Both are probed with marker-gated checks — the response has to contain the structure only that component produces.
// API SERVER critical
// KUBELET critical
A reachable kubelet is worse than it looks: the same anonymous access that lists pods generally allows command execution inside them.
Management interfaces
// tool: probe_unauth_interfacesOne always-on probe covers seventeen products. Each row carries its own confirmation marker — a JSON key, a response header, an exact body string — and all markers must hold before anything is recorded. That is why a generic branded login page at /api/health produces nothing.
| Product | Probe | Confirmation marker | Severity |
|---|---|---|---|
| Vault | /v1/sys/health | Seal/init status JSON from the secrets manager itself. | critical |
| Docker registry | /v2/_catalog | A repositories list — your private images, enumerable. | critical |
| Kubernetes API / Dashboard | /api · /version · / | APIVersions JSON, or the dashboard shell served anonymously. | critical |
| Jenkins | /api/json | An X-Jenkins header — jobs, builds and the script console are reachable. | high |
| Grafana | /api/health | Health JSON carrying database + version. | high |
| Consul | /v1/status/leader · /v1/kv/?recurse | A raft leader ip:port, or KV entries — the config/secret store, world-readable. | high |
| etcd | /version | An etcdserver key — the datastore behind the cluster. | high |
| Prometheus | /api/v1/status/config | The running YAML config — scrape targets and any embedded credentials. | high |
| Elasticsearch / Kibana | / · /api/status | The cluster banner (cluster_name, lucene_version) or Kibana's status document. | high |
| phpMyAdmin · Adminer · mongo-express | / | The database admin UI answering without authentication. | high |
| ClickHouse · InfluxDB | /?query=SELECT%201 · /ping | A query that actually executes, or the version header on ping. | high |
| Django / Flask debug | / | A debug traceback page — settings, environment, and in Flask's case an interactive console. | high |
| Directory listing | / | An autoindex page enumerating files the server was never meant to publish. | medium |
Spring Boot actuators are deliberately not in this list — they have their own graded ladder on the Spring Boot page.
Datastores on the network
// tool: datastore_exposure (network scan mode)In network mode the same discipline applies below HTTP: a datastore port is only a finding when it answers a real protocol command without credentials. A port that is closed, or open but demanding auth, is silently safe.
REDIS
An unauthenticated INFO reply — full read/write to the keyspace, and often a persistence-based path to code execution.
MEMCACHED
Anonymous stats/version response — cached session data readable, and a UDP amplification source.
ELASTICSEARCH
Cluster banner returned to an anonymous caller — every index queryable.
MONGODB
An unauthenticated buildInfo — which also yields the version the CVE dataset needs. See the MongoDB page.
World-listable cloud storage
// tool: cloud_storage_scan (opt-in)The classic leaky bucket, on S3, GCS or Azure Blob. The signal is unambiguous: an anonymous request that comes back with a provider bucket listing root. An AccessDenied means the bucket exists but is private — recorded as inventory, not as a finding.
// LISTING-ROOT SIGNATURES
// WHY IT'S OPT-IN
This check reaches provider hosts, not your target, so it stays outside the scan's scope lock unless you ask for it: name the buckets, give explicit URLs, or let it derive candidate names from the target host. A full CIS cloud-posture review — IAM, security groups, account config — needs authenticated cloud API access and is honestly out of scope for a credential-free scan.
How it's recorded
// audit-ready evidenceCATEGORY
Exposed interfaces map to CWE-284 and A05 misconfiguration — the control every framework words as "administrative access is restricted".
SEVERITY
One calibrated severity per finding that translates into each framework's risk rating and remediation SLA — no inflated numbers.
EVIDENCE
The probed URL, the marker that confirmed the product, and the response that proves it answered without credentials.
Find it before someone else does.
NewScan is free and self-hosted — bring your own key. Every probe on this page is credential-free, read-only and runs in the deterministic floor with no model or provider key at all.