PAN-OS GlobalProtect Portal Scanner

Determine the Palo Alto PAN-OS software version of a remote GlobalProtect portal or management interface.

Developed with ❤️ by the Bishop Fox Cosmos (formerly CAST) team.

• Description
• Getting started
• Back matter

Description

Palo Alto's GlobalProtect portal, a feature of PAN-OS, has been the subject of several critical-severity vulnerabilities that can allow authorization bypass, unauthenticated remote code execution, etc. From an external perspective, it can be difficult to tell if you're running a patched version of PAN-OS since the GlobalProtect portal and management interface don't explicitly reveal their underlying software version.

To assist PAN-OS users in patching their firewalls, this scanner examines the Last-Modified and ETag HTTP response headers for several static web resources, and associates those values with specific PAN-OS releases. For example, note the ETag in the following HTTP response from the GlobalProtect portal login page:

$ curl -skI https://example.com/login/images/favicon.ico
HTTP/1.1 200 OK
Date: Tue, 02 Dec 2025 20:37:26 GMT
Content-Type: image/x-icon
Content-Length: 720
Connection: keep-alive
ETag: "6901103a-2d0"
Cache-Control: max-age=86400
Accept-Ranges: bytes

Examining the last 8 characters of the ETag before the "-" gives us the hexadecimal epoch time 6901103a, represented as 1761677370 in decimal format. We can convert this epoch time to a human-readable format using the UNIX date utility: Note : old format was just the first 8 chars, there was no "-"

$ date -d @1761677370
Tue Oct 28 18:49:30 UTC 2025

Using the attached version-table.txt, we can determine that this instance of GlobalProtect portal is running on PAN-OS version 8.1.10, and is therefore vulnerable to CVE-2020-2034, an OS command injection vulnerability in GlobalProtect portal, and should consequently be patched.

$ awk '/Aug.*21.*2019/ {print $1}' version-table.txt 
8.1.10

This scanner automates the process described above, suggesting an exact (or approximate) underlying PAN-OS version for a remote GlobalProtect portal or management interface. When multiple versions are associated with a given date, this tool will display all version matches as a comma-separated list; e.g, 7.1.24-h1,8.0.19-h1,8.1.9-h4 for 2019-08-15.

Getting started

Install

$ git clone https://github.com/noperator/panos-scanner.git

Install dependencies

$ pip install -r requirements.txt

Usage

Note that this script requires version-table.txt in the same directory.

$ python3 panos-scanner.py -h
usage: panos-scanner.py [-h] [-v] [-s] [-cve] [-i] (-t TARGET | -f FILE)

Determine the software version of a remote PAN-OS target. Requires version-table.txt in the same directory. See https://security.paloaltonetworks.com/?product=PAN-OS for security
advisories for specific PAN-OS versions.

options:
  -h, --help  show this help message and exit
  -v          verbose output (-v for verbose, -vv for very verbose with full headers)
  -s          stop after one exact match
  -cve        Add link to official PAN security advisory page
  -i          Disable TLS certificate verification (NOT recommended).
  -t TARGET   https://gp.example.com or gp.example.com
  -f FILE     inputfile. One target per line. See target format

In the following example, https://example.com/global-protect/portal/images/favicon.ico has an HTTP response header that indicates that it's running PAN-OS version 8.0.10.

$ python3 panos-scanner.py -s -t https://example.com | jq '.match'
{
    "date": "2025-10-28",
    "versions": [
      "11.2.7-h4"
    ],
    "precision": "exact",
    "resource": "login/images/favicon.ico"
}

Back matter

Legal disclaimer

Usage of this tool for testing targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state, and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program.

Acknowledgements

Thanks @k4nfr3 for providing updates to the version table, and for building in the option to print a URL for Palo Alto's security advisories page.

See also

• Shodan Facet Analysis — PAN-OS Version
• A Look at PAN-OS Versions with a Bit of R
• Palo Alto Networks Security Advisories

To-do

• Stop after one exact match
• Simplify output
• Support verbose CLI option
• Process target from input file
• Perhaps output JSON instead, to be processed with jq
• Add link to CVE PaloAltoNetworks Page

License

This project is licensed under the MIT License.