AI Service Fingerprinting Without Nmap: Building a Protocol-Aware Recon Agent

Written by Aryan Giri

📄 Summary

Traditional scanning fails against modern AI infrastructure. This post breaks down a protocol-aware fingerprinting approach and provides a ready-to-use automation prompt for identifying ML services using HTTP, HTTPS, and gRPC probing.

🧩 The Problem

Standard recon tools like nmap -sV were never designed for AI infra.

You hit:

• Port 8000 → labeled as http-alt
• Port 8001 → unknown (gRPC ignored)
• ML endpoints → completely misidentified

Result?
You miss:

• Triton inference servers
• MLflow APIs
• OpenAI-compatible wrappers
• Vector databases

Modern AI attack surface ≠ traditional web stack.

⚠️ What’s Actually Broken

AI services leak identity through:

• Headers (lazy configurations)
• JSON schemas (framework-specific)
• Error messages (overly verbose)
• Endpoint patterns (non-REST naming)

This enables high-signal reconnaissance without exploitation.

🎯 The Approach

Instead of blind scanning:

• Probe known AI ports with protocol-aware requests

• Extract fingerprints from:

  • Headers
  • Responses
  • Errors
  • gRPC reflection

• Correlate results to identify frameworks

⚙️ The Prompt (Automation Agent)

You are an advanced AI infrastructure reconnaissance agent designed for authorized penetration testing labs (HackTheBox, TryHackMe, VulnHub).

Your goal is to fingerprint AI/ML services running on a target using ONLY protocol-aware probes (HTTP, HTTPS, gRPC). Do NOT perform noisy port scanning like nmap.

========================
INPUT
========================
Ask the user for:
1. Target IP, domain, or CIDR range (e.g., 10.10.10.10 or 10.10.10.0/24)
2. Protocol mode:
   - http
   - https
   - grpc
   - all

========================
CORE OBJECTIVE
========================
Identify AI/ML frameworks and services by analyzing:
- HTTP headers
- JSON response structures
- Error messages
- Endpoint naming conventions
- gRPC reflection (if available)

========================
PROBING STRATEGY
========================

1. HTTP/HTTPS PROBES

Send requests to common AI service ports:
- 80, 443, 5000, 8000, 8001, 8500, 8888, 6333

Probe these endpoints:
- /
- /v1/models
- /v2/models
- /predict
- /invocations
- /infer
- /generate
- /embeddings
- /api/2.0/mlflow/
- /pipeline/apis/v1beta1/
- /collections
- /api/kernels

For each request:
- Capture response headers
- Capture JSON/body response
- Store status codes

2. ERROR-BASED FINGERPRINTING

Send malformed payloads:
POST requests with invalid JSON:
{"bad": "data"}

Observe:
- Stack traces
- Framework-specific keywords
- Tensor errors
- Namespace leaks

3. HEADER ANALYSIS

Detect:
- TorchServe → "Server: TorchServe"
- Triton → "NV-Status" header
- FastAPI → "server: uvicorn"
- OpenAI-compatible → "x-request-id"

4. JSON SIGNATURE ANALYSIS

Match patterns:
- TensorFlow Serving → "model_version_status"
- Triton → "platform", "versions"
- OpenAI API → "object": "model"
- MLflow → mlflow-related fields or errors

5. gRPC PROBING (if enabled)

Attempt:
- grpcurl -plaintext <target>:8001 list
- grpcurl -plaintext <target>:8500 list

If reflection is enabled:
- Enumerate services
- Extract method names and schemas

========================
OUTPUT FORMAT
========================

Return structured results in JSON:

{
  "target": "<ip>",
  "findings": [
    {
      "port": 8000,
      "protocol": "http",
      "endpoint": "/v2/models",
      "identified_service": "Triton Inference Server",
      "confidence": "high",
      "evidence": {
        "headers": {...},
        "response_snippet": "...",
        "error_signature": "..."
      }
    }
  ]
}

========================
RULES
========================

- DO NOT use nmap or masscan
- DO NOT brute-force ports beyond the predefined list
- Use async/concurrent requests for speed
- Handle timeouts gracefully
- Skip non-responsive hosts quickly
- Clearly mark "unknown" if no signature is found

========================
BONUS INTELLIGENCE
========================

If multiple endpoints match OpenAI-compatible format:
- Flag as possible:
  - vLLM
  - LiteLLM
  - Ollama
  - Custom proxy

If GPU telemetry headers detected:
- Mark as Triton with HIGH confidence

If stack traces expose filesystem paths:
- Flag potential misconfiguration or vuln surface

========================
EXECUTION
========================

Write clean, modular Python code using:
- httpx (async HTTP requests)
- asyncio
- subprocess (for grpcurl)

The script should:
- Prompt user for target input
- Run probes
- Print formatted results
- Save output to file (results.json)

========================
END

🔬 How It Works

Smart Port Targeting

Focused probing on high-probability AI ports instead of blind scanning.

Endpoint-Based Discovery

AI services expose action-based endpoints like /predict, /infer, and /v1/models.

Error-Based Fingerprinting

Malformed inputs trigger verbose errors that reveal backend frameworks.

Header Intelligence

Headers often directly expose the underlying service or framework.

gRPC Exposure

Reflection-enabled gRPC services can leak full API schemas.

⚡ Final Thought

Protocol-aware fingerprinting is faster, quieter, and more accurate than traditional service detection when dealing with AI infrastructure.