Inventory and assess network-connected equipment.
ShakerScan treats TVs, cameras, printers, routers, NAS systems, conference equipment, and other network-connected devices as a separate security surface. A device scan inventories TCP and UDP services, fingerprints open ports, checks SSH posture, and passively tests web interfaces on any port, with explicit coverage and safety profiles. Adaptive device investigation uses the same Hunt runtime under stricter policy.
Who it is for. Security and IT teams responsible for office, lab, and home-office equipment that is not a web application but still has a network attack surface.
What problem it solves
Devices are not web targets, even when they expose a web interface. Mixing them into a web scanner distorts posture metrics and applies the wrong safety assumptions to fragile embedded systems.
ShakerScan keeps a durable device identity with a mutable locator, records every address change, and separates device findings from ordinary DAST metrics.
How it works
- 01Start the opt-in device worker so an existing DAST installation does not lose scan capacity.
- 02Register one hostname or IP per device and confirm authorization. URLs, CIDR ranges, paths, and credentials are rejected as locators.
- 03Choose a coverage profile: inventory (priority ports), posture (all 65,535 TCP ports), or thorough (deeper fingerprinting).
- 04Choose a safety profile: observe_only, safe_remote (default), or authenticated_active with device-bound encrypted credentials. ShakerScan never guesses credentials.
- 05A multi-signal reachability preflight runs first; the safety governor assigns every action a safety class and records health checkpoints. If a healthy device degrades, the scan halts.
- 06For adaptive investigation, run a Hunt with the device target kind. It can reach operator-selected services on nonstandard ports and run four allowlisted Nmap scripts; model-authored SSH commands stay inert until you confirm the exact plan.
What you get
- A durable device identity with interface, service, and locator history.
- Device findings with a device-scoped fingerprint, filtered separately from web posture.
- Passive web-interface testing on any port through hidden device-owned scans that never touch web target statistics.
- Hunt history for device investigations and encrypted, redacted request collections imported from Postman, HAR 1.2, OpenAPI 3.x, or Swagger 2.0.
Example workflow
# Start the dedicated device worker and check tool readinessshakerscan devices startshakerscan devices status # In the web UI: Connected Devices → add the device → confirm# authorization → choose coverage and safety profiles → scan.
Security and authorization
- Only assess devices you own or are explicitly authorized to test. Embedded systems can be fragile; ShakerScan records baseline, post-inventory, and final health checkpoints and halts on degradation.
- Coverage and safety are independent controls. A deeper coverage profile never grants permission for more invasive actions.
- Postman scripts, HAR responses, and external specification references never execute. State-changing HTTP methods require a separate authenticated-active approval.
Limitations
- The lab_invasive profile is reserved for a dedicated recovery-capable lab runner and currently fails closed as unavailable.
- Each scan covers exactly one device. Network ranges are out of scope by design.
- Device assessment is network-facing posture, not firmware analysis.
Get started
- 01Install ShakerScan and run shakerscan devices start.
- 02Open Connected Devices, add the device by hostname or IP, and confirm authorization.
- 03Run a posture scan with the default safe_remote profile and review the service inventory and findings.
- 04For deeper review, add a device-bound credential profile or start a Hunt with the device target kind.