Credentialed Pre-Port Discovery: Don't Probe the Host, Ask it
Rapid7's version 8.58 adds credentialed pre-port discovery, letting scan engines query hosts for listening TCP/UDP ports instead of network probing.
Rapid7 documents credentialed pre-port discovery, available from version 8.58 as an off-by-default per-template option under Asset Discovery. The scan engine authenticates with existing SSH, Scan Assistant, or Windows credentials and receives the host's authoritative list of listening TCP and UDP ports, skipping the network port scan. Hosts without matching credentials silently fall back to network port scanning. Trade-offs include reporting firewall-blocked ports the engine cannot reach, longer scans, and early termination findings caused by repeated connection failures.
- Available from version 8.58 as an off-by-default checkbox per scan template under Asset Discovery.
- Credential preference order: Scan Assistant, then SSH, then direct Windows connection.
- Hosts without matching credentials silently fall back to network port scanning.
- Unreachable reported ports can cause timeouts, longer scans, and host-scan-terminated findings.
- Vendors
- Rapid7
- Products
- Scan Assistant
- Organizations
- Rapid7
From the original article
5 min read at rapid7.com
If your scan engine already holds credentials for a host, it can ask that host which ports are open instead of probing for them. Every scan begins with the same question: which ports on this host are open? Everything after it, from identifying services to checking for vulnerabilities to evaluating policy, depends on the answer being right.
By Conor McCormick · rapid7.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.