Cloud Attack Surface Mapping with masscan and TLS Fingerprinting

Cloud Network Forensics | SEC504 | Jun 2026

Swept 65,536 addresses in 10.200.0.0/16 for port 443 with masscan at 10,000 packets/sec, which returned 14 live TLS hosts. Extracted the IPs with awk, pulled every certificate with tls-scan (14/14 handshakes in 0.13s), and parsed the subject CN with jq. Most certs were wildcards for unrelated tenants (*.genusight.com, *.sunsetisp.com, *.wright.art), but one host, 10.200.74.2, presented downloads.falsimentis.com, the target. An nmap http-enum against it found nginx 1.18.0 exposing /robots.txt and a /css/ directory listing.

Tools: masscan 1.3.9, tls-scan, jq, awk, Nmap 7.60, Slingshot Linux

Commands

1. Mass-sweep the /16 for port 443

Ran masscan across the entire 10.200.0.0/16 (65,536 hosts) for a single port at 10,000 packets/sec. The list output (-oL) recorded 14 open 443/tcp hosts. Scanning one port across a huge range is the fast way to find the live TLS surface before spending time on any single host.

masscan -p 443 --rate 10000 -oL simcloud.txt 10.200.0.0/16
wc -l simcloud.txt

-p 443: single port --rate 10000: packets per second -oL: list output format

2. Extract the live IPs

masscan -oL lines look like 'open tcp 443 10.200.x.x <epoch>'. awk pulled field 4 (the IP) into a clean target list for the certificate scan.

awk '/open/ {print $4}' simcloud.txt > simcloud-targets.txt

/open/: match result lines {print $4}: the IP address column

3. Collect TLS certificates

tls-scan read the target list on stdin and completed all 14 handshakes in 0.13 seconds, writing structured JSON. This is the step that turns a list of anonymous IPs into a set of certificates that name their services.

tls-scan --port=443 --cacert=/opt/tls-scan/ca-bundle.crt -o simcloud-tlsinfo.json < simcloud-targets.txt

--port=443: TLS port --cacert: CA bundle for chain validation -o: JSON output; reads targets on stdin

4. Attribute IPs by certificate subject CN

jq projected each IP next to its certificate subject CN. Most were wildcards for unrelated tenants sharing the cloud range (*.genusight.com, *.sunsetisp.com). One stood out: 10.200.74.2 presenting downloads.falsimentis.com, the target organization.

jq '.ip + " " + .certificateChain[].subjectCN' simcloud-tlsinfo.json
jq '.ip + " " + .certificateChain[].subjectCN' simcloud-tlsinfo.json | grep falsimentis

certificateChain[].subjectCN: the CN names the service grep isolates the target's asset

5. Enumerate the identified host

With the target IP known, nmap -sV plus the http-enum NSE script fingerprinted nginx 1.18.0 and surfaced /robots.txt and a browsable /css/ directory listing. Attribution first, enumeration second, so the noisy scan only ever touches the one host that matters.

sudo nmap -sT -sV -p 443 --script http-enum 10.200.74.2

-sV: version detection --script http-enum: enumerate web paths

Key Findings

masscan found 14 live 443/tcp hosts in a 65,536-address /16 in seconds
TLS certificate subject CN attributed each anonymous cloud IP to an owner
10.200.74.2 = downloads.falsimentis.com, the target, isolated by a single grep
nginx 1.18.0 on the target exposed /robots.txt and a /css/ directory listing

Security Controls

Continuous external attack surface management over owned cloud ranges
Certificate transparency / inventory keyed on subject CN
Disabling directory listing (autoindex) on web servers
Egress and ingress controls limiting which cloud hosts expose 443