Discover internet-wide misconfigurations in services like Elasticsearch, databases, and web servers using high-speed scanning tools.
Netz is an open-source security tool that scans the entire internet to discover misconfigured services like Elasticsearch, databases, and web servers that are publicly accessible without authentication. It combines masscan for rapid port scanning and zgrab2 for application-layer probing to identify vulnerable assets efficiently. The project addresses the critical need for organizations to verify their external exposure and prevent accidental data leaks.
Security researchers, penetration testers, and DevOps engineers responsible for assessing external attack surfaces and ensuring services are not inadvertently exposed. It's also suitable for red teams conducting reconnaissance and blue teams validating security controls.
Netz offers a high-performance, self-hosted alternative to commercial scanners like Shodan, with the flexibility to run on custom infrastructure and scan specific protocols. Its unique selling point is the ability to achieve internet-wide scans in minutes using PF_RING ZC and cloud automation, providing granular control over scanning parameters.
Discover internet-wide misconfigurations while drinking coffee
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Leverages PF_RING ZC for packet rates up to 12M PPS, enabling internet-wide scans in minutes, as shown in the README's performance results.
Uses zgrab2 modules to scan services like Elasticsearch and databases, with the ability to add new protocols via Go extensions.
Includes a cloud runner tool that automates AWS ECS setup, IAM roles, and infrastructure, reducing manual overhead for large-scale scans.
Can run via Docker, on cloud instances with multiple NICs, or with specialized hardware, offering options from basic to high-performance setups.
PF_RING ZC requires specific Intel NICs, kernel module configuration, and a license, making initial setup challenging and costly.
The cloud runner tool is designed exclusively for AWS, limiting portability to other cloud providers without significant re-engineering.
masscan's high-speed scanning can 'meltdown' networks, potentially affecting SSH and other services during scans, as warned in the README.
Netz is an open-source alternative to the following products:
Censys is a cybersecurity platform that provides internet-wide scanning and data analysis to help organizations discover and monitor their digital assets and identify security risks.
Shodan is a search engine for internet-connected devices, allowing users to find specific types of computers, servers, IoT devices, and their vulnerabilities.
ZoomEye is a cyberspace search engine and network reconnaissance tool that allows users to discover and analyze internet-connected devices and services.