16 min read

🛡️ Auditing the Castle: How to Scan and Pen-Test Your Homelab (2026 Guide)

Stop guessing if your self-hosted infrastructure is secure. Use Shodan, Greenbone OpenVAS in Docker, and Trivy to audit your homelab like a professional.
Shodan.io map view of Toronto & area, Canada showing detected IPV4 & IPV6 addresses.
Shodan.io map view of Toronto & area, Canada showing detected IPV4 & IPV6 addresses.

So let's say you worked hard setting up your environment, you are happy you finally have things humming along... You locked it down a reasonable amount. You’ve deployed the SWAG reverse proxy. You've even got CrowdSec watching the perimeter. But in the world of technical network defense, there is one golden rule: If you aren't actively scanning your own network, someone else is.

A truly hardened homelab isn't defined by what you think you secured - it’s defined by what an aggressive, automated subnet scan actually uncovers.

Here's how to see what the bots & script kiddies see, easily.

This post is for paying subscribers only