# Bitcoin Node Pentesting

> How to enumerate and assess Bitcoin nodes during security assessments. Use this skill whenever the user mentions Bitcoin nodes, cryptocurrency pentesting, ports 8333/18333/38333/18444, or wants to enumerate Bitcoin network infrastructure. This skill covers mainnet, testnet, signet, and regtest Bitcoin node enumeration using Nmap scripts and Shodan queries.

- Skill: `abelrguezr/bitcoin-node-pentesting` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/bitcoin-node-pentesting`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/bitcoin-node-pentesting/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/bitcoin-node-pentesting

---


# Bitcoin Node Pentesting

A skill for enumerating and assessing Bitcoin nodes during security assessments.

## When to Use This Skill

Use this skill when:
- You need to enumerate Bitcoin nodes on a target network
- You're assessing cryptocurrency infrastructure security
- You encounter open ports 8333, 18333, 38333, or 18444
- You want to gather information about Bitcoin network nodes
- You're performing reconnaissance on Bitcoin-related services

## Bitcoin Network Ports

| Port | Network | Description |
|------|---------|-------------|
| 8333 | Mainnet | Production Bitcoin network |
| 18333 | Testnet | Bitcoin test network |
| 38333 | Signet | Bitcoin signet (alternative testnet) |
| 18444 | Regtest | Local/regtest Bitcoin network |

## Enumeration Methods

### Method 1: Nmap Bitcoin Scripts

Nmap includes specialized scripts for Bitcoin node enumeration. These scripts communicate with the node as if you were another valid Bitcoin node.

#### Get Basic Node Information

```bash
# Mainnet (port 8333)
sudo nmap -p 8333 --script bitcoin-info <target-ip>

# Testnet (port 18333)
sudo nmap -p 18333 --script bitcoin-info <target-ip>

# Signet (port 38333)
sudo nmap -p 38333 --script bitcoin-info <target-ip>

# Regtest (port 18444)
sudo nmap -p 18444 --script bitcoin-info <target-ip>
```

**What this reveals:**
- Timestamp of the node
- Network type (main/test/signet/regtest)
- Bitcoin Core version
- Node ID
- Last block height
- User agent string

#### Get Known Peer Addresses

```bash
# Get list of peers the node knows about
sudo nmap -p 8333 --script bitcoin-getaddr <target-ip>
```

**What this reveals:**
- IP addresses of other Bitcoin nodes
- Timestamps for each peer
- Can help map the Bitcoin network topology

### Method 2: Shodan Queries

Use Shodan to discover Bitcoin nodes on the internet.

#### Basic Queries

```bash
# Find Bitcoin mainnet nodes
port:8333 bitcoin

# Find nodes with specific user agent
User-Agent: /Satoshi

# Combine for more specific results
port:8333 "Satoshi"
```

#### Advanced Queries

```bash
# Find specific Bitcoin Core versions
port:8333 "Satoshi:0.19.1/"

# Find nodes in specific countries
port:8333 country:US

# Find nodes with specific software
port:8333 "Satoshi:24.0/"
```

## Example Workflow

### Step 1: Identify Bitcoin Nodes

```bash
# Scan for Bitcoin ports
nmap -p 8333,18333,38333,18444 <target-ip>
```

### Step 2: Enumerate Node Information

```bash
# Get detailed node info
sudo nmap -p 8333 --script bitcoin-info <target-ip>
```

### Step 3: Map Network Topology

```bash
# Get peer list to understand network connections
sudo nmap -p 8333 --script bitcoin-getaddr <target-ip>
```

### Step 4: Document Findings

Record:
- Node version and software
- Network type (mainnet/testnet/signet/regtest)
- Last block height (indicates sync status)
- Known peers (for network mapping)
- Any unusual configurations

## Important Notes

1. **Permission Required**: Always ensure you have authorization before scanning Bitcoin nodes
2. **Network Impact**: Enumeration queries are lightweight but can add minimal load
3. **Version Detection**: User agent strings reveal Bitcoin Core versions which may have known vulnerabilities
4. **Network Mapping**: bitcoin-getaddr can reveal other nodes in the network
5. **Test Networks**: Testnet (18333) and signet (38333) are safe for testing; mainnet (8333) should only be scanned with permission

## Common Use Cases

- **Security Assessment**: Identify outdated Bitcoin Core versions with known vulnerabilities
- **Network Discovery**: Map Bitcoin node infrastructure in a target environment
- **Compliance Audit**: Verify Bitcoin node configurations meet security requirements
- **Research**: Study Bitcoin network topology and node distribution

## Output Format

When documenting Bitcoin node enumeration results, use this structure:

```
## Bitcoin Node Assessment

### Target: <IP/Hostname>

**Port:** 8333 (mainnet)
**Status:** Open

### Node Information
- **Version:** <Bitcoin Core version>
- **Network:** <mainnet/testnet/signet/regtest>
- **Node ID:** <hex identifier>
- **Last Block:** <block height>
- **User Agent:** <full user agent string>

### Known Peers
- <peer IP>:8333
- <peer IP>:8333
- ...

### Security Observations
- <any relevant findings>
```

## Related Skills

- Network enumeration skills for other cryptocurrency protocols
- Nmap scripting for service enumeration
- Shodan reconnaissance techniques