A Generalized Fingerprinting Framework for Deriving Searchable Features to Identify Publicly Exposed Infrastructure#

Bilal Hassan, Bob van der Kamp (NCSC-NL / University of Amsterdam)

• Why: Post-disclosure, "find every vulnerable host before attackers do" is a networking problem — and the feature table reaches into exactly the L3/L4 quirks you know well (TTL, DF, TOS, TCP MSS differences between PLC vendors).
• What: A NCSC-NL-commissioned methodology (master thesis, UvA) formalizing how analysts derive a working Censys/Shodan query for a specific vulnerable product/version: a decision tree whose leaves are either an effective query or the conclusion none exists; a cross-domain feature table (certificates, HTML, CSS, URL paths, TTL/TOS/DF values, MSS — e.g., Schneider PLC MSS 1380 vs. Siemens 1460); and a CLI prototype automating feature identification and query construction, with real vulnerability examples.
• How: Interview-based formalization of ad-hoc expert practice into a reproducible decision procedure, then partial automation of feature extraction.
• Where applicable: CERTs and any team under NIS2-style exposure-management pressure; works for any internet-exposed product with distinguishing observable features, though products with no unique fingerprint legitimately yield "no query". (from abstract only)