UPnP BHunter provides a three-step hunting console:

• UPnP Discovery (definition of target IP address version and discovery of active UPnP via SSDP protocol)
• UPnP Selection (selection of the found UPnP service)
• UPnP Attack (extraction of the found UPnP SOAP requests).