Test Network Services
Overview
Establish what is actually listening and reachable before making vulnerability claims. Keep discovery, identification, configuration review, authentication tests, and exploit validation as separate authorized levels.
Read references/network-test-levels.md before selecting tools or scan intensity.
Workflow
- Load approved targets/exclusions, source addresses, network path, time/rate limits, credentials, and contacts.
- Resolve target identity.
- Record DNS, addresses, cloud/CDN/load-balancer ownership, environment, and routes; stop on third-party or out-of-scope resolution.
- Discover conservatively.
- Start with known assets and low-rate reachability/port checks; record tool/version/options, packet source, loss, and filtering.
- Identify services.
- Validate protocol, TLS/certificate, banner/version, authentication exposure, and application behavior instead of trusting port numbers or one fingerprint.
- Assess configuration and exposure.
- Review unnecessary listeners, network boundary, encryption, weak/default access, anonymous behavior, management interfaces, and segmentation from approved vantage points.
- Validate vulnerability candidates.
- Review scanner/template logic and use the smallest protocol-aware proof; route protocol mechanics to
network-protocol-skills.
- Stop and clean up.
- Halt on instability, rate-limit distress, unexpected sensitive data, third parties, or scope drift; close sessions and remove temporary access.
Output
Return target resolution, discovery coverage, validated services, configuration/exposure observations, vulnerability candidates/validation, negative results, impact, and cleanup.
1---2name: test-network-services3description: Test authorized network services with bounded discovery and protocol-aware validation. Use for hosts, ranges, ports, TLS, banners, versions, authentication, exposure, segmentation, configuration, packet evidence, or vulnerability checks.4---56# Test Network Services78## Overview910Establish what is actually listening and reachable before making vulnerability claims. Keep discovery, identification, configuration review, authentication tests, and exploit validation as separate authorized levels.1112Read [references/network-test-levels.md](references/network-test-levels.md) before selecting tools or scan intensity.1314## Workflow15161. Load approved targets/exclusions, source addresses, network path, time/rate limits, credentials, and contacts.172. Resolve target identity.18 - Record DNS, addresses, cloud/CDN/load-balancer ownership, environment, and routes; stop on third-party or out-of-scope resolution.193. Discover conservatively.20 - Start with known assets and low-rate reachability/port checks; record tool/version/options, packet source, loss, and filtering.214. Identify services.22 - Validate protocol, TLS/certificate, banner/version, authentication exposure, and application behavior instead of trusting port numbers or one fingerprint.235. Assess configuration and exposure.24 - Review unnecessary listeners, network boundary, encryption, weak/default access, anonymous behavior, management interfaces, and segmentation from approved vantage points.256. Validate vulnerability candidates.26 - Review scanner/template logic and use the smallest protocol-aware proof; route protocol mechanics to `network-protocol-skills`.277. Stop and clean up.28 - Halt on instability, rate-limit distress, unexpected sensitive data, third parties, or scope drift; close sessions and remove temporary access.2930## Output3132Return target resolution, discovery coverage, validated services, configuration/exposure observations, vulnerability candidates/validation, negative results, impact, and cleanup.
gaelic-ghost