VIPERDEN
Deep Network Discovery & Vulnerability Scanner
• Active1. Snapshot
2. What ViperDen Is
ViperDen is a deep, on-demand network investigation platform. An analyst drops a lightweight daemon onto a network — a laptop walked into a site, an RMM-deployed host, or a Pi shipped to a remote location — runs a comprehensive scan, and gets a rich, evidence-backed picture of everything on that network: what's there, what's running, what's wrong, and what doesn't belong.
ViperDen solves the problem of deep on-demand investigation of a network from inside it. It is not a 24/7 sentinel keeping a diagram current over time. It is a scanner the analyst points at a network when they need answers. Scan history is preserved on the central server for later comparison, but the daemon stays idle between jobs — it is a pure execution engine, not a continuous monitor.
ViperDen doesn't just fingerprint services. ViperDen investigates devices.
3. Key Capabilities
Site-to-Site Subnet Discovery
Discovers and scans remote-site subnets automatically over a hub-and-spoke VPN with no prior knowledge of their CIDRs, reading the gateway firewall's routing table over SNMP and reporting an honest coverage verdict — authoritative when routes were read, partial (verify) when they could not be.
Banner + CVE Correlation
Service version fingerprinting on every open port, matched against a local cached NVD/OSV database for vulnerability identification.
Web Service Surface Analysis
Security headers (HSTS, X-Frame-Options, CSP), TLS certificate details and expiry warnings, version disclosure, exposed common paths (.git/, .env, /admin), and default credential checks for known appliances on any HTTP/HTTPS service.
SMB Enumeration
Null session checks, anonymous share listing, SMB signing status, SMBv1 detection, and OS detection over SMB.
Default Credential & Anonymous File Testing
Credential checks against fingerprinted appliances — printers, IPMI/iLO/iDRAC, cameras, routers — plus "here's what's exposed without credentials" file listing across SMB, FTP, NFS, and TFTP.
Multi-Source Device Naming
Names combined from DNS (reverse and forward sweep), NetBIOS, mDNS, LLMNR, and SNMP.
Device Classification with Vendor Icons
Leads with strong, daemon-independent signals (hostname patterns, OEM vendors, Windows service ports), then layers ports, banners, names, and OS to classify each host — workstation, server, domain controller, printer, camera, network device, appliance/IoT — consistently whether a scan captured a lot or a little. Every device carries a vendor icon and category badge.
OS Fingerprinting & Multi-Site Detection
Active TCP/IP stack probes identify host operating systems, and remote sites reached through site-to-site VPN tunnels are discovered using subnet, hop count, and latency signals, then auto-grouped into labeled zones on the network map.
4. Architecture: Central + Daemon Model
ViperDen runs as a central server paired with lightweight, deployable daemons. The central server owns everything except scan execution; daemons execute on the networks they're dropped into and stream results back.
| Component | Responsibilities |
|---|---|
| Central Server | Hosts the web UI (the analyst workspace); owns the database of scan history, findings, and the daemon registry; handles authentication (multi-user, deployed single-user); generates per-daemon install scripts and one-time install tokens; orchestrates scans, receives streamed results, and renders the network map and reports. |
| Daemon | A single static binary (~15 MB, no runtime dependencies) targeting Linux, macOS, Windows, and ARM Linux. Registers with central via a one-time install token, swaps it for a persistent daemon token, receives scan jobs over a persistent connection, executes locally, and streams results back over TLS. Stores nothing persistent and phones home over outbound HTTPS — working through NAT with no inbound firewall changes. |
The daemon is written in Go to deliver a single static binary per OS, fast startup, easy cross-compilation, and excellent networking primitives well-suited to scanning workloads. Scanning is hybrid — active probes run according to the chosen profile while a passive listener folds in chatty devices via ARP, DHCP, mDNS, LLMNR, SSDP, and NetBIOS. Two safety triggers auto-throttle: OT/ICS detection (industrial MAC OUIs drop to passive-only) and tunnel detection (high hop count and latency reduce the scan rate to protect VPN bandwidth).
5. Scan Profiles
| Profile | Duration | Coverage |
|---|---|---|
| Quick | ~5–10 min | Host discovery, top 1000 TCP, banner grab, MAC + reverse DNS, basic device classification |
| Standard (default) | ~30–45 min | Top 1000 TCP + top 100 UDP, full service version detection, CVE matches, web surface checks, SMB enumeration, all name sources (DNS/NetBIOS/mDNS/SNMP), full device classification |
| Deep | ~2–4 hr | All 65535 TCP + top 1000 UDP, everything Standard does, default credential testing, anonymous share/FTP/NFS file listing, full TLS analysis on every HTTPS service, active OS fingerprinting |
| Custom | Variable | Every toggle exposed |
Reporting is half the product: an interactive network map with clickable, vendor-iconed nodes color-coded by criticality and remote sites grouped into labeled zones; a per-host detail dossier backing every finding with raw banners and responses; a severity-sorted vulnerability findings list; a plain-language executive summary; a diff view comparing any two scans; and PDF / JSON / PNG / CSV export.
6. Screenshots
7. License
ViperDen is Proprietary — All Rights Reserved. It is a self-hosted platform: the central server never phones home to any external service, all daemon traffic runs over TLS, and scan data stays entirely on the self-hosted instance.