DEV Community

StarkMan
StarkMan

Posted on

phpIPAM: 4,238 title matches for the address register that maps a network

#infosec #networking #php #security

phpIPAM: 4,238 title matches for the address register that maps a network

phpIPAM is an open-source IP address management application. Teams use it to record subnets, addresses, VLANs and device ownership, and it gradually becomes the authoritative map of where things live. That is why it is worth measuring: an address register is a targeting document, and it is frequently deployed by exactly the small teams that have no spare staff to harden it.

What the queries returned

Two queries against the ZoomEye international index on 8 October 2026 with sub_type set to all and a page size of one. The application fingerprint query app="phpIPAM" returned 2 matches. The title query title="phpIPAM" returned 4,238 matches.

Reading a near-empty fingerprint count

A count of two is not evidence that almost nobody runs this software. It is evidence that the scanner rarely sees a response fingerprint it associates with the product. phpIPAM is a PHP application behind a web server, so the response carries whatever the administrator configured: a custom title, a login redirect, an authentication proxy in front. The title count of 4,238 covers a broader population, and it includes pages that mention the product without hosting an instance.
Taken together the two figures say something narrow but useful. The product is widely deployed enough to appear across thousands of indexed pages, and it does not present a stable banner. For a defender, banner-based discovery will not find it, so an inventory has to come from configuration management rather than from scanning.

Why an address register is sensitive

Subnet boundaries, VLAN identifiers and gateway addresses together describe how a network is segmented. Device records attach hostnames, owners and often the asset's function. Sections and custom fields are where teams record circuit identifiers, support contracts and occasionally the credentials for network equipment, because the register is the natural place to keep a note that the address is in use.
The application's own account model matters too. Administrative users can export the whole database, and export is a normal feature rather than an exploit. A read-only account on this system is still a read of the network map.

Defensive implications

  • Do not publish the register on the internet. If remote users need it, place it behind a VPN or an identity-aware proxy with multi-factor authentication.
  • Review every account and its role, and remove export privileges from accounts that only need to read and edit addresses.
  • Check custom fields for credentials that were recorded as notes, and move anything found into a secret manager.
  • Confirm that the database and its backups are encrypted, since the register is a map in a single file.
  • Keep the application patched, and treat any public proof-of-concept for an IPAM product as applicable to your deployment until you have checked the version.

References

Top comments (0)