HTTP + TLS deep probe

What it is

After every open port is found, Umbra runs a deep probe to capture every piece of evidence the fingerprinter and the CVE matcher will need downstream. One pass per port; no second scan needed for any later analysis.

What it produces

Per service:

• HTTP: status code, full response headers (every header, not just Server), response body up to 256 KB, parsed <title>, body sha256, title sha256, redirect chain.
• TLS, full leaf certificate: CN, SAN list, issuer, NotBefore, NotAfter, sha256 fingerprint, self-signed flag, wildcard flag.
• Favicon: Shodan-style mmh3 hash + base64 thumbnail for the UI (image-sniffed so a JSON 404 doesn’t poison the hash).
• Banner: passive TCP read on ports that don’t speak HTTP (SSH version string, MySQL handshake, SMTP greeting, etc.).
• Active probe: for silent ports (Postgres, Redis, RDP, MSSQL), a tiny, READ-ONLY, standards-compliant identify request when the passive read returned nothing.

What to use it for

• Driving the fingerprinter (product / version / CPE)
• Pivoting by favicon hash to find every host running the same internal admin panel
• Auditing TLS hygiene: self-signed certs on prod, expired certs, internal CN names leaking
• Reproducing a finding: the captured body is what the AI agent reads to build its exploit hypothesis

Why it matters

Bare port-scan output (“80/tcp open”) tells you nothing about exploitability. Everything Umbra does after discovery (fingerprint, CVE match, AI exploit chain) reads from the evidence the probe collects on this pass. Skimping here means re-scanning to ask any follow-up question.

Why it’s valuable

• Single-pass evidence. No “re-probe to see headers.”
• Same shape inside and outside. Internal-agent probes capture the same fields, so internal services search and filter identically.
• Forensic depth. The bodies + sha256s mean you can prove what was on that endpoint at scan time even if the live response changes between then and the ticket review.

How to use it

Nothing to configure. Runs as part of every discovery scan. Open a service detail page to see all captured fields, or use the SmartSearch tokens (title:, banner:, cert_cn:, favicon:, status:) to filter the inventory.