said by planet:
Wouldn't GRC Shields Up work for this? I thought the scan pinged port 1900 UPnP.
We need someone vulnerable to try it. To my knowledge, GRC only does TCP and this port is UDP, at least to start. I'm pretty sure Steve is isolating the scan out to be very specific and, if I know Steve, it might query for info (but maybe not, too).