Shieldome has always covered the OWASP Top 10 - injection, misconfiguration, broken authentication, and the rest of the list. Starting today, three new scanning capabilities are available on every scan: port and service exposure detection, CVE lookup, and passive subdomain and attack surface discovery. Here is what each one does and why it matters.

Port and service exposure scan

A web application vulnerability scanner that only checks the web layer misses a large class of real-world incidents. Exposed databases, management interfaces, and remote-access services sitting directly on the public internet are responsible for a significant share of breaches - not because attackers exploited a complex chain of vulnerabilities, but because a port simply should not have been open.

Shieldome now performs a TCP connect scan across the top 20 most commonly abused ports on every target host:

If a dangerous service is found open, the finding is rated HIGH and the remediation guidance is specific: restrict to trusted IP ranges, use VPN or SSH tunnelling for remote admin, and never expose a database directly to the internet.

CVE detection

Shieldome already fingerprints server software, CMS platforms, JavaScript libraries, and frameworks from HTTP headers, HTML meta tags, page markup, and response patterns. Version detection is the first step — CVE lookup is what makes it actionable.

For each detected component, the NVD API is queried for matching CVEs. Results include the CVE ID, CVSS base score, severity rating (Critical / High / Medium / Low), and a description of the vulnerability. If a patch or version upgrade is available, the remediation note links directly to the vendor advisory.

This means a single scan can now tell you not just "this server is running Apache 2.4.49" but "Apache 2.4.49 has CVE-2021-41773, a path traversal and RCE vulnerability with CVSS 9.8 — upgrade immediately."

Subdomain and attack surface discovery

The domain you scan is rarely the only one that matters. Staging environments, API subdomains, admin panels, and forgotten test instances are common entry points for attackers. Shieldome now performs passive subdomain discovery on every scan using public DNS and certificate transparency logs.

Discovered subdomains are listed in the results with their IP addresses. Subdomains that appear to be admin panels, staging environments, or API gateways are flagged for manual review. This gives you a picture of your attack surface beyond the URL you explicitly scanned.

What this means for your scans

All three capabilities are enabled automatically on every scan — no configuration needed. Port exposure and CVE findings appear in the main findings list with severity ratings and remediation guidance. Subdomain discovery results appear in a dedicated section of the report.

If you have existing scheduled scans, they will pick up the new checks automatically on the next run. If you want results now, trigger a manual scan on any of your targets.