http-evm-rpc-info
A Lua NSE script that fingerprints EVM JSON-RPC endpoints using client banners, RPC metadata and fallback heuristics.
Problem#
A generic HTTP service probe does not explain which EVM execution client is behind a JSON-RPC endpoint, which network it serves or how much information it exposes.
Implementation#
The published Nmap Scripting Engine script sends HTTP JSON-RPC requests to query web3_clientVersion, eth_chainId, eth_blockNumber and net_peerCount. It maps known chain IDs to network names and adds client information to Nmap’s service output when a banner is available.
When the client banner is unavailable, it examines method-not-found responses and probes Erigon, Hardhat and Anvil namespaces for fallback clues. These are heuristic inferences, not guaranteed client identification. HTTP 401 and 403 responses are reported as restricted visibility rather than bypassed.
The repository also includes a Python mock RPC server and shell test runner for several response profiles.
Scope#
The implementation is an HTTP JSON-RPC tool. DevP2P/RLPx handshakes and P2P scanning are not implemented.
The article explains the motivation and NSE approach. Only scan systems you own or are authorised to assess.