I am looking for help on how to set up a scan that looks for any machine offering a web service on our internal network. If it is a TCP port, and it is responding in HTTP/HTTPS, I want to know about it.
I am not just looking for things on ports 80/443, because many of the management ports out there do not use standard ports (i.e. tcp/8083).
I know that doing an exhaustive scan on all TCP ports would take forever. I already have a list of all hosts in my environment, and could use that to build a scan. I just want to find a solution that will find a high-percentage (ideally all) of the strange-numbered HTTP/HTTPS services that are out there.
I searched the forums and the help documentation and haven't found anything close to what I'm looking for. Has anyone tackled this problem before, or have any good ideas on how to go about doing this?