Please enable JavaScript.
Coggle requires JavaScript to display documents.
AI Asset & Shadow AI Scanner - Coggle Diagram
AI Asset & Shadow AI Scanner
Start: Target IP / Subnet
Run Nmap / Naabu
Sends SYN packets to each port
Responses: open / closed / filtered
Open Ports Discovered
22 · 80 · 3306 · 5000 · 8080
AI hint ports
11434 = Ollama
7860 = Gradio
8888 = Jupyter
5000 = Flask / FastAPI
Unknown port
Banner grab to identify
Fallback: try HTTP probe first
httpx + Nuclei
httpx
Grabs tech stack and headers
Detects Flask / FastAPI / Gradio
No credentials needed
Nuclei templates
AI-specific YAML probes
Ollama: /api/tags lists models
Gradio: /info shows AI interface
Jupyter: check unauthenticated access
Log Analysis
Log Sources
nginx access.log
Which IP hit AI endpoint
POST /chat · POST /complete
auth.log
Which user owns AI deployment
DNS logs
api.openai.com lookups
huggingface.co queries
App logs
Custom AI app logging
LangChain trace logs
Permissions Needed
SSH credentials required
sudo for auth.log
Read access on /var/log/
Limitations
Logs may be rotated or empty
Shadow AI apps skip logging
Log path varies by distro
Fallback
No log access = low confidence finding
Use ports and connections as evidence
Note unaudited surface in report