Powershell list all web services in a network

xoxo 1 Reputation point
2021-10-31T23:54:31.48+00:00

Hello

I am looking for a way in powershell to retrieve all web services accross a network and have an output such as:

Computer Port Full URL

192.168.1.7 8443 https://192.168.1.7:8443
10.250.7.3 8009 https://10.250.7.3:8009

Ideally with the service (eg HP Printer, Konica...)

I know how to parse from a CSV file (I already have a CSV with all my computers), and I know how to loop.
Just I tried with Get-CmiInstance to list services but it doesnt give the output I am looking for, and I tried and Get-ChildItem Cert:\ -Recurse but I didnt find the certificates I am looking for, and anyway it doesnt give me the port and URL

Could you pls give me some hints how to achieve what I am looking for?

Windows Server PowerShell
Windows Server PowerShell
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.PowerShell: A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
5,355 questions

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. xoxo 1 Reputation point
    2021-11-01T13:14:03.057+00:00

    Well I need this to identify in a network all web services because I need to test all of them, are their certificate up to date? Which service do they run (printer...)? then I have additional tasks to perform such as testing if they are accessible via default creds (yes sometimes admins are lazy and I have to make sure they created a specific account to access those web services, meaning log in).

    I do use nmap but its output doesn't suit me, I would prefer to have a table that look like as above. Just imagine in a network with different subnets, nmap is too verbose and its a hell to parse it.

    I am not looking for RPC, just links that I can access via HTTP or HTTPS.
    However they are not always on 80 or 443, sometimes they have different ports, and this is why I want to list all of them to make sure I don't miss any.

    I honestly didn't think of Ipv6 but good point, yes I am looking for listing web services on both Ipv4 and Ipv6, on all ports

    0 comments
  2. Rich Matheisen 44,621 Reputation points
    2021-11-01T14:35:00.25+00:00

    Here's what I think you'd need to do. It is, of course, just a rough skeleton of the code you'd need (and it doesn't cover IPv6!): 

    $ports = 1024..64536
$networks = "192.168.1.0/16", "10.250.7.0/16"

$networks |
    ForEach-Object{
        # get the number of hosts in the subnet
        # start at the 1st host
        # increment by 1 and check the the octet doesn't exceed 255 (or 254?)
        # adjust octets accordingly
        # OR
        # convert subnet to decimal and increment while in range
        # remember that decimal numbers are treated as IPv4 addresses!
        $ports |
            ForEach-Object{
                # use [System.Net.WebClient] or [system.net.http.httpclient]
                # to try connecting
                # create a PSCustomObject to hold results
            }
    } | Export-Csv SomeFile.csv -NoTypeInformation

    You'd also do well to use PowerShell jobs to get some parallelism! Testing that many ports is bound to take some time, and a lot of the time is going to be spend waiting for a connection to reply or to time-out. I don't know how many networks you have, or how much of your networks address space is unused.

    0 comments