Skip to content
HackIndex logo

HackIndex

Identifying Exposed Model Servers and Inference APIs

3 min read Mar 18, 2026

Model serving infrastructure is frequently misconfigured and exposed directly to the internet. Ollama, LocalAI, Text Generation Inference, vLLM, and similar self-hosted model servers often run without authentication by default. Cloud AI services like SageMaker endpoints, Vertex AI endpoints, and Azure ML deployments are sometimes deployed with overly permissive access controls. Finding these before the engagement moves into active testing gives you direct access to the model without going through the application layer.

Search Shodan for Known Model Server Ports

Common model serving frameworks listen on predictable default ports. Search Shodan for the target organisation's IP ranges on these ports:

┌──(kali㉿kali)-[~]
└─$ shodan search 'org:"Target Organisation" port:11434' --fields ip_str,port,hostnames
┌──(kali㉿kali)-[~]
└─$ shodan search 'org:"Target Organisation" http.title:"Ollama"' --fields ip_str,port,hostnames

Default ports for common model servers:

  • Ollama — 11434
  • LocalAI — 8080
  • Text Generation Inference (TGI) — 3000 or 8080
  • vLLM — 8000
  • LM Studio server — 1234
  • llama.cpp server — 8080
  • OpenWebUI — 3000 or 8080

Search Shodan and Censys for Vector Databases

Vector databases running alongside model servers are often exposed on their own default ports:

┌──(kali㉿kali)-[~]
└─$ shodan search 'org:"Target Organisation" port:6333 OR port:6334' --fields ip_str,port,hostnames
┌──(kali㉿kali)-[~]
└─$ shodan search 'org:"Target Organisation" port:8000 http.html:"chroma"' --fields ip_str,port,hostnames

Default ports for common vector databases:

  • Qdrant — 6333 (REST), 6334 (gRPC)
  • Chroma — 8000
  • Weaviate — 8080
  • Milvus — 19530
  • Pinecone — cloud-hosted, no fixed port but API endpoints discoverable

Scan for Model Servers with nmap

Against in-scope IP ranges, scan for model server ports with service detection:

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 11434,8080,8000,3000,1234,6333,6334,19530,9200 $TARGET_IP_RANGE -oG nmap-ai-ports.txt
┌──(kali㉿kali)-[~]
└─$ grep 'open' nmap-ai-ports.txt | grep -iE '11434|ollama|inference|model|llm'

Confirm Ollama Exposure

Ollama's REST API exposes model management endpoints. If port 11434 responds, confirm it is Ollama and list available models:

┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:11434/api/tags | python3 -m json.tool 
{
    "models": [
        {
            "name": "llama3.1:8b",
            "size": 4661224676,
            "digest": "46e0c10c039e..."
        },
        {
            "name": "mistral:7b",
            "size": 4113301824
        }
    ]
}

An exposed Ollama instance with no authentication gives full access to all hosted models, including the ability to pull new models, delete existing ones, and run completions against any model on the server. This is a critical finding. Proceed to exploitation directly.

Confirm vLLM and TGI Exposure

vLLM and Text Generation Inference both expose OpenAI-compatible APIs. Check the models endpoint:

┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:8000/v1/models | python3 -m json.tool 
{
    "object": "list",
    "data": [
        {"id": "meta-llama/Llama-3.1-8B-Instruct", "object": "model"}
    ]
}

Check Cloud AI Service Exposure

AWS SageMaker endpoints are accessed via the AWS API but misconfigured IAM policies sometimes allow unauthenticated access. Check whether the endpoint responds without credentials:

┌──(kali㉿kali)-[~]
└─$ curl -sk -X POST https://runtime.sagemaker.$AWS_REGION.amazonaws.com/endpoints/$ENDPOINT_NAME/invocations -H 'Content-Type: application/json' -d '{"inputs":"test"}'

A response other than a 403 or authentication error confirms the endpoint accepts unauthenticated requests. SageMaker endpoint names are often guessable from application configuration files, environment variable leaks, or error messages found during web application reconnaissance.

References