cyber.hendryadrian.com
Security Insights · resecurity.com

Guide Details Reconnaissance of Modern AI Infrastructure

· Original article ↗

Summary

The guide explains how to fingerprint and enumerate AI infrastructure—including inference servers, MLflow, vector databases and notebooks—and how exposed APIs, metrics, credentials and dependencies can reveal systems and create security risks.

Key points

  • The guide identifies inference servers, model registries, orchestration platforms, vector databases, notebooks and storage as components of the AI attack surface.
  • It describes fingerprinting AI services through response headers, API formats, error messages, endpoint patterns and gRPC behavior.
  • Exposed MLflow APIs may reveal experiment and model metadata, artifact locations, project names and training details.
  • Unauthenticated vector database interfaces and metrics endpoints may expose schemas, collection metadata and operational information.
  • The article warns that exposed Jupyter notebooks can provide code execution and may contain credentials or cloud access tokens.
  • It describes risks from exposed management interfaces, including unauthorized model registration in TorchServe and access to Kubeflow-connected infrastructure.
  • The guide also covers supply-chain reconnaissance, including exposed Hugging Face tokens and dependency confusion risks in ML pipelines.

Article Details

Topic
Reconnaissance and attack-surface mapping of AI/ML infrastructure, including service fingerprinting, API enumeration, metadata exposure, and supply-chain risks.

MITRE ATT&CK

T1046 · Network Service DiscoveryThe article describes identifying AI services through port scanning and enumeration of exposed service interfaces.T1595 · Active ScanningThe article describes active scanning of exposed AI infrastructure and common service ports to identify accessible systems.

Vendors

AmazonThe /invocations endpoint is particularly important because it is strongly associated with Amazon SageMaker deployments.Hugging FaceHugging Face tokensNvidia1.1 NVIDIA Triton Inference Server

Products

Jupyter NotebookJupyter notebook exposureKubeflow2.2  KubeflowMinIO5.2  MinIO Object StorageMLflowMLflow and vector database enumerationNVIDIA Triton Inference Server1.1 NVIDIA Triton Inference ServerQdrant3.2  Qdrant EnumerationRay Framework2.3  Ray FrameworkTensorFlow Serving1.2 TensorFlow ServingTorchServe1.3 TorchServeWeaviateSome platforms, such as Weaviate, also expose GraphQL APIs that provide additional schema visibility.

Tools

grpcurlUsing grpcurlNmapnmap -p 5000,6333,8000,8001,8002,8080,8265,8500,8501,8888,9000,11434,19530 -sV --script=http-title,http-headers <target>

Related Articles