Comprehensive security measures and Server-Side Request Forgery (SSRF) protection
The TYCHON scanner implements context-aware network security measures. SSRF protection applies only to integration service configurations (Kafka, Elasticsearch, Splunk, S3) while allowing full network access for legitimate security scanning via -host flags.
-host (no restrictions)The scanner uses a sophisticated context-aware validation system that applies different security rules based on how network inputs are being used:
# Integration services - PROTECTED by SSRF validation
-elasticnode "http://localhost:9200" # Internal Elasticsearch - ALLOWED
-kafkabrokers "localhost:9092" # Internal Kafka - ALLOWED
-splunkurl "http://10.0.0.15:8088" # Internal Splunk - ALLOWED
-s3endpoint "http://localhost:9000" # MinIO local storage - ALLOWED
# Integration services - BLOCKED by SSRF protection
-elasticnode "http://169.254.169.254/" # AWS metadata - BLOCKED
-kafkabrokers "127.0.0.1:6379" # Redis on non-Kafka port - BLOCKED
-splunkurl "http://localhost:22" # SSH port - BLOCKED
# Scan targets - NO SSRF restrictions (legitimate security scanning)
-host "localhost:8080" # Local web app - ALLOWED for scanning
-host "192.168.1.100:443" # Internal server - ALLOWED for scanning
-host "10.0.0.50:22" # SSH service - ALLOWED for scanning
-host "169.254.169.254:80" # Even metadata service - ALLOWED for scanningThese IP ranges are blocked only when configuring integration services (Kafka, Elasticsearch, Splunk, S3). Scan targets using -host can access any IP range for legitimate security assessments.
| Range | Description |
|---|---|
| 127.0.0.0/8 | Localhost loopback |
| 127.0.0.1 | Primary localhost |
| 127.1 | Short form localhost |
| 2130706433 | Decimal form of 127.0.0.1 |
| 017700000001 | Octal form of 127.0.0.1 |
| 0x7f000001 | Hex form of 127.0.0.1 |
| Range | Description |
|---|---|
| 10.0.0.0/8 | Private Class A |
| 172.16.0.0/12 | Private Class B |
| 192.168.0.0/16 | Private Class C |
| 169.254.0.0/16 | Link-local APIPA |
| Range | Description |
|---|---|
| 0.0.0.0/8 | "This network" |
| 224.0.0.0/4 | Multicast addresses |
| 240.0.0.0/4 | Reserved/Experimental |
| Range | Description |
|---|---|
| ::1 | IPv6 loopback |
| [::1] | Bracketed IPv6 loopback |
| fe80::/10 | Link-local addresses |
| Range | Description |
|---|---|
| fc00::/7 | Unique local addresses |
| fd00::/8 | Unique local addresses |
| ::ffff:0:0/96 | IPv4-mapped IPv6 |
| ff00::/8 | Multicast addresses |
These ports are blocked only when configuring integration services (Kafka, Elasticsearch, Splunk, S3) to prevent SSRF attacks. Scan targets using -host can access any port for legitimate security scanning.
| Port | Service |
|---|---|
| 22 | SSH |
| 23 | Telnet |
| 25 | SMTP |
| 53 | DNS |
| 110 | POP3 |
| 143 | IMAP |
| 993 | IMAPS |
| 995 | POP3S |
| Port | Database |
|---|---|
| 3306 | MySQL |
| 5432 | PostgreSQL |
| 6379 | Redis |
| 11211 | Memcached |
| 27017 | MongoDB |
| Port | Service |
|---|---|
| 8080 | HTTP Alt |
| 8443 | HTTPS Alt |
| 9200 | Elasticsearch HTTP |
| 9300 | Elasticsearch Transport |
Note: Internal services like Elasticsearch on localhost:9200 or Kafka on localhost:9092 can use these ports without restriction because they use the ContextInternalService validation context. Scan targets using -host can always access these ports for legitimate security assessments.
# Use encrypted credential storage
certscanner -config
# Configure with secure endpoints
certscanner -config-elasticnode "https://elastic.internal:9200"
certscanner -config-kafkabrokers "kafka1.internal:9092"
certscanner -config-splunkurl "https://splunk.company.com:8088"# Set via environment variables
export ELASTIC_NODE="https://localhost:9200"
export KAFKA_BROKERS="localhost:9092"
export SPLUNK_URL="http://splunk.internal:8088"
export SPLUNK_TOKEN="your-secure-token-here"The scanner includes intelligent credential detection and redaction in logs:
password=***REDACTED***apikey=***REDACTED***token=***REDACTED***Enhanced file permission security for temporary files and outputs:
0600 (owner read/write only)0600 (owner read/write only)0700 (owner access only)0600Problem: Getting connection errors when trying to configure Kafka on localhost or private IP.
Solution: Ensure you're using the correct flag for internal service configuration:
certscanner -posttokafka -kafkabrokers "localhost:9092"This uses ContextInternalService validation which allows localhost and private IPs.
Problem: Cannot configure local Elasticsearch instance.
Solution: Use proper internal service configuration:
certscanner -posttoelastic -elasticnode "http://localhost:9200"The ContextInternalService validation allows access to blocked ports for configured services.
Problem: Cannot connect to IPv6 internal services.
Solution: IPv6 localhost and private addresses are supported for internal services:
certscanner -kafkabrokers "[::1]:9092"
certscanner -elasticnode "http://[fd00::100]:9200"Use bracket notation for IPv6 addresses in URLs.
If you encounter security-related issues or have questions about network configuration, check the main documentation or contact your system administrator for guidance on enterprise security policies.