Find the admin tools, databases, and cloud buckets that aren't supposed to be on the internet.
Service exposure is the unsexy category that causes the most breaches. Someone stands up a dev environment, an admin panel, or a cloud storage bucket — and forgets to put auth in front of it, or misconfigures the firewall, or leaves a port open. Nano EASM catches those before an opportunistic attacker does.
What we detect
- Exposed admin panels — Jenkins, GitLab, Grafana, Kubernetes dashboard, Portainer, phpMyAdmin, dozens more.
- Database ports open to the internet — MySQL, PostgreSQL, MongoDB, Redis, Elasticsearch, Memcached, plus their default-credential variants.
- Cloud storage buckets, container registries, and serverless endpoints accessible without authentication.
- Internal-facing dev/test endpoints (Webpack dev server, Storybook, Swagger UI, Spring Boot Actuator) on production hostnames.
- Shadow IT — services on subdomains the IT inventory doesn't know about.
Why it matters
Exposed services are unauthenticated entry points. They don't need a CVE to be a problem — exposure is the problem. Most ransomware groups, opportunistic scanners, and credential-stuffing botnets find their targets by scanning for these services first, then trying default creds or known weaknesses. The public-internet attack surface assumption is that anything reachable will be probed within minutes.
How Nano EASM detects it
Discovery enumerates subdomains, IPs, and CIDR ranges via certificate transparency logs, DNS, passive sources, and (for paid plans) Shodan. The Shodan engine surfaces every open port and service banner. The HTTP engine fingerprints exposed admin panels by their distinctive paths and response signatures. The cloud-asset engine probes cloud-bucket and registry candidates derived from your domain and brand. Every finding includes the asset, port, service, and a confidence indicator.
Common scenarios
Forgotten Jenkins on a dev subdomain
A dev set up Jenkins for a side project two years ago, behind no auth, on dev.acme.com:8080. Discovery finds the subdomain. The HTTP engine fingerprints the Jenkins login page. Alert in your Slack within the hour.
S3 bucket spelled like the company name
Cloud-asset enumeration generates likely bucket names from your domain (acme-prod, acme-backups, acme-uploads). The cloud-asset engine probes each for public list/read access. Findings include the URL and exact AWS bucket name.
Mongo on an EC2 with the firewall off
Discovery finds the EC2's elastic IP. Shodan reports port 27017 open with a Mongo banner. Nuclei confirms the database is reachable without auth. Three engines, one finding, one Slack message.
Try it free against your domain
Quick Scan runs the engines that surface service exposure findings, plus the rest of the platform's coverage. No signup, no credit card, real results in under a minute.