From Scanning to Self-Assessment: Using ZoomEye to Inventory Your Own Attack Surface

从扫描到自我评估：利用 ZoomEye 盘点自身的攻击面

Internet-wide scanners are a double-edged tool. Attackers use them to find exposed systems; defenders can use the same capability to discover what they have accidentally exposed. In 2026, government advisories have repeatedly pointed to scanning services as part of the attacker’s workflow, which makes the defensive use of the same data both practical and urgent. This article explains how to turn ZoomEye measurement into a self-assessment routine.

全网扫描器是一把双刃剑。攻击者利用它们寻找暴露的系统；防御者也可以利用同样的能力，发现自己无意中暴露了哪些资产。2026 年，政府发布的多次安全公告都指出，扫描服务已成为攻击者工作流程的一部分，这使得防御性地利用这些数据变得既实用又紧迫。本文将介绍如何将 ZoomEye 的测量转化为一种日常的自我评估流程。

The problem and why it matters

问题所在及其重要性

Most organizations do not have a complete, current picture of what is reachable from the internet. Assets are added by different teams, exposed temporarily for a project, and forgotten. Attackers do not rely on the organization’s inventory; they rely on the internet’s actual state. The gap between the two is where breaches begin. In the August 2026 advisory on Siemens S7 PLCs, the scanning step was explicit: attackers used services like Censys and ZoomEye to find exposed controllers before generating exploits.

大多数组织对于互联网上哪些资产是可访问的，并没有一个完整且实时的认知。资产由不同的团队添加，可能仅因某个项目临时暴露，随后便被遗忘。攻击者并不依赖组织的资产清单，他们依赖的是互联网的真实状态。这两者之间的差距正是漏洞入侵的起点。在 2026 年 8 月关于西门子 S7 PLC 的安全公告中，扫描步骤被明确提及：攻击者在生成漏洞利用程序之前，使用了 Censys 和 ZoomEye 等服务来寻找暴露的控制器。

Context and method

背景与方法

The approach is straightforward. For each technology an organization runs, construct a fingerprint query and check whether any of its own assets appear. The counts below, collected with ZoomEye on 2026-09-19 (sub_type “all”, pagesize one), illustrate the scale of common technologies and give a sense of which fingerprints return meaningful results.

这种方法非常直接。针对组织运行的每一种技术，构建一个指纹查询，并检查是否有自己的资产出现在结果中。以下数据于 2026 年 9 月 19 日通过 ZoomEye 收集（sub_type 为 “all”，pagesize 为 1），展示了常见技术的规模，并让读者了解哪些指纹能返回有意义的结果。

app=“nginx” returned 309,196,565 matches and app=“Apache” returned 594,958,906, showing how ubiquitous web servers are. app=“WordPress” returned 7,881,967 and app=“Exchange” returned 2,357,417, two of the most commonly exposed application platforms. app=“VMware” returned 1,423,789 and app=“Fortinet” returned 4,523,889, reflecting large virtualization and network-security footprints. app=“MongoDB” returned 680,348, a database that should rarely be internet-facing. These figures are global totals, not an organization’s own exposure. Their value is as a reference point: they show that the technologies most organizations run are also the technologies most present on the open internet, which means accidental exposure is common.

app=“nginx” 返回了 309,196,565 条匹配结果，app=“Apache” 返回了 594,958,906 条，显示了 Web 服务器的普及程度。app=“WordPress” 返回了 7,881,967 条，app=“Exchange” 返回了 2,357,417 条，这是两种最常被暴露的应用平台。app=“VMware” 返回了 1,423,789 条，app=“Fortinet” 返回了 4,523,889 条，反映了庞大的虚拟化和网络安全设备覆盖面。app=“MongoDB” 返回了 680,348 条，这是一种本不应面向互联网的数据库。这些数字是全球总量，而非某个组织自身的暴露情况。它们的价值在于提供了一个参考点：它们表明，大多数组织运行的技术，也是互联网上最常见的技术，这意味着意外暴露是非常普遍的。

Interpretation and practical value

解读与实际价值

The self-assessment workflow has four steps. First, enumerate the technologies the organization runs and the fingerprints that identify them. Second, run scoped queries and compare the results to the internal asset inventory. Third, investigate every match that the inventory does not explain. Fourth, remediate by removing unnecessary exposure and patching what must remain public. The most valuable output of this process is the unexpected match: a service that appears in an external scan but not in the inventory. That is an unknown exposure, and it is exactly the kind of asset attackers find first. Treating each unexpected match as a finding, rather than dismissing it as a false positive, is what makes the routine effective.

自我评估流程分为四个步骤。第一，列举组织运行的技术及其对应的识别指纹。第二，运行范围查询，并将结果与内部资产清单进行比对。第三，调查每一个在资产清单中无法解释的匹配项。第四，通过移除不必要的暴露和修补必须公开的服务来进行修复。此过程中最有价值的产出是“意外匹配”：即出现在外部扫描中但未出现在内部清单中的服务。这属于未知暴露，正是攻击者最先发现的那类资产。将每一个意外匹配视为一个发现，而不是将其作为误报忽略，才是使该流程有效的关键。

Implications and next steps

启示与后续步骤

Build a fingerprint list for your technologies. Map each major platform to a query that identifies it.
Run the comparison on a schedule. Exposure changes as assets are added and removed.
Prioritize unexpected matches. An asset you did not know was public is the highest-value finding.
Combine measurement with patching. Exposure plus an unpatched version is the dangerous combination.
Keep the process defensive. The same queries that find your exposure also find an attacker’s targets; use them to close gaps, not to scan systems you do not own.
为你的技术构建指纹列表。 将每个主要平台映射到识别它的查询语句上。
定期运行比对。 随着资产的添加和移除，暴露情况会发生变化。
优先处理意外匹配。 你不知道已公开的资产是价值最高的发现。
将测量与修补相结合。 暴露加上未修补的版本是危险的组合。
保持防御性。 那些能发现你暴露点的查询同样能发现攻击者的目标；请利用它们来弥补漏洞，而不是扫描不属于你的系统。

ZoomEye’s practical value for defenders is that it answers a question inventories often cannot: what does the internet actually see? For organizations that want to reduce their attack surface, that answer is the starting point.

ZoomEye 对防御者的实际价值在于，它回答了资产清单往往无法回答的问题：互联网到底看到了什么？对于想要减少攻击面的组织来说，这个答案就是起点。