# Identifying Exposed Model Servers and Inference APIs

> Techniques for discovering publicly exposed ML model servers, inference endpoints, and AI APIs through passive recon, port scanning, and service fingerprinting.

- **URL:** https://hackindex.io/platforms/ai/reconnaissance/identifying-exposed-model-servers-and-inference-apis
- **Path:** AI Platforms > Reconnaissance
- **Up:** [Reconnaissance](https://hackindex.io/platforms/ai/reconnaissance.md)
- **Published:** 2026-03-18
- **Updated:** 2026-08-11

Model serving infrastructure is frequently misconfigured and exposed directly to the internet. Ollama, LocalAI, Text Generation Inference, vLLM, and similar self-hosted model servers often run without authentication by default. Cloud AI services like SageMaker endpoints, Vertex AI endpoints, and Azure ML deployments are sometimes deployed with overly permissive access controls. Finding these before the engagement moves into active testing gives you direct access to the model without going through the application layer.

## Search Shodan for Known Model Server Ports

Common model serving frameworks listen on predictable default ports. Search Shodan for the target organisation's IP ranges on these ports:

```bash
shodan search 'org:"Target Organisation" port:11434' --fields ip_str,port,hostnames
```

```bash
shodan search 'org:"Target Organisation" http.title:"Ollama"' --fields ip_str,port,hostnames
```

Default ports for common model servers:

- **Ollama**: 11434
- **LocalAI**: 8080
- **Text Generation Inference (TGI)**: 3000 or 8080
- **vLLM**: 8000
- **LM Studio server**: 1234
- **llama.cpp server**: 8080
- **OpenWebUI**: 3000 or 8080

## Search Shodan and Censys for Vector Databases

Vector databases running alongside model servers are often exposed on their own default ports:

```bash
shodan search 'org:"Target Organisation" port:6333 OR port:6334' --fields ip_str,port,hostnames
```

```bash
shodan search 'org:"Target Organisation" port:8000 http.html:"chroma"' --fields ip_str,port,hostnames
```

Default ports for common vector databases:

- **Qdrant**: 6333 (REST), 6334 (gRPC)
- **Chroma**: 8000
- **Weaviate**: 8080
- **Milvus**: 19530
- **Pinecone**: cloud-hosted, no fixed port but API endpoints discoverable

## Scan for Exposed Model Servers and Inference APIs with nmap

Against in-scope IP ranges, scan for model server ports with service detection:

```bash
nmap -sV -p 11434,8080,8000,3000,1234,6333,6334,19530,9200 $TARGET_IP_RANGE -oG nmap-ai-ports.txt
```

```bash
grep 'open' nmap-ai-ports.txt | grep -iE '11434|ollama|inference|model|llm'
```

## Confirm Ollama Exposure

Ollama's REST API exposes model management endpoints. If port 11434 responds, confirm it is Ollama and list available models:

```bash
curl -sk http://$TARGET_IP:11434/api/tags | python3 -m json.tool
# {
#     "models": [
#         {
#             "name": "llama3.1:8b",
#             "size": 4661224676,
#             "digest": "46e0c10c039e..."
#         },
#         {
#             "name": "mistral:7b",
#             "size": 4113301824
#         }
#     ]
# }
```

An exposed Ollama instance with no authentication gives full access to all hosted models, including the ability to pull new models, delete existing ones, and run completions against any model on the server. This is a critical finding. Proceed to exploitation directly.

## Confirm vLLM and TGI Exposure

vLLM and Text Generation Inference both expose OpenAI-compatible APIs. Check the models endpoint:

```bash
curl -sk http://$TARGET_IP:8000/v1/models | python3 -m json.tool
# {
#     "object": "list",
#     "data": [
#         {"id": "meta-llama/Llama-3.1-8B-Instruct", "object": "model"}
#     ]
# }
```

## Check Cloud AI Service Exposure

AWS SageMaker endpoints are accessed via the AWS API but misconfigured IAM policies sometimes allow unauthenticated access. Check whether the endpoint responds without credentials:

```bash
curl -sk -X POST https://runtime.sagemaker.$AWS_REGION.amazonaws.com/endpoints/$ENDPOINT_NAME/invocations -H 'Content-Type: application/json' -d '{"inputs":"test"}'
```

A response other than a 403 or authentication error confirms the endpoint accepts unauthenticated requests. SageMaker endpoint names are often guessable from application configuration files, environment variable leaks, or error messages found during web application reconnaissance.

## References

- [Ollama: API documentation](https://github.com/ollama/ollama/blob/main/docs/api.md) - Full REST API reference including model management endpoints
- [Hugging Face: Text Generation Inference](https://github.com/huggingface/text-generation-inference) - TGI server API reference and default port configuration