Active Reconnaissance & Network Scanning

Actively probe targets with Nmap, Nessus, and enumeration tools to discover open ports, services, OS fingerprints, and vulnerabilities — building a complete attack surface map.

Medium 60m 3 tasks

Prerequisites: Ethical Hacking Methodology & Passive Reconnaissance

Learning Objectives

→ Use Nmap for host discovery, port scanning, service and OS detection
→ Perform service enumeration: SMB, FTP, HTTP, SSH, SNMP
→ Run Nessus and OpenVAS for automated vulnerability scanning
→ Use Gobuster/ffuf for web directory and file discovery
→ Interpret scan results to prioritize attack vectors

Nmap – The Essential Scanner

Host Discovery

# Ping sweep — find live hosts (requires no port scan)
nmap -sn 192.168.1.0/24

# ARP discovery (local network — more reliable)
nmap -PR 192.168.1.0/24

# Disable ping (test all hosts even if ICMP blocked)
nmap -Pn 192.168.1.100

# TCP SYN discovery
nmap -PS22,80,443 192.168.1.0/24

# ICMP timestamp
nmap -PP 192.168.1.0/24

Port Scanning

# SYN scan (default, fast, stealthy)
nmap -sS target.com

# Full TCP connect (when SYN needs root privileges)
nmap -sT target.com

# UDP scan (slow but important — many services: DNS 53, SNMP 161)
nmap -sU target.com

# Scan specific ports
nmap -p 22,80,443,3306 target.com
nmap -p 1-1000 target.com
nmap -p- target.com               # all 65535 ports

# Fast scan — top 100 ports
nmap -F target.com

# Top 1000 ports (default)
nmap target.com

Service & Version Detection

# Service version detection
nmap -sV target.com
# Output: 22/tcp open  ssh     OpenSSH 7.9 (protocol 2.0)
#         80/tcp open  http    Apache httpd 2.4.38
#         3306/tcp open  mysql  MySQL 5.7.32

# OS detection (requires root)
nmap -O target.com
# Output: OS: Linux 4.15 (95% confidence)

# Full detection (-A = -sV -O -sC --traceroute)
nmap -A target.com

# Default NSE scripts (-sC)
nmap -sC target.com

Nmap NSE Scripts

# List available scripts
ls /usr/share/nmap/scripts/ | grep smb

# Run specific script
nmap --script smb-vuln-ms17-010 target.com    # EternalBlue
nmap --script http-title target.com
nmap --script ftp-anon target.com

# Run category of scripts
nmap --script vuln target.com           # all vulnerability scripts
nmap --script discovery target.com     # discovery scripts
nmap --script auth target.com          # auth checks

# Common vulnerability scripts
nmap --script smb-vuln-ms08-067 target.com     # MS08-067
nmap --script http-shellshock target.com       # Shellshock
nmap --script ssl-heartbleed target.com        # Heartbleed

# Save output
nmap -oN output.txt target.com         # normal text
nmap -oX output.xml target.com         # XML (for import to tools)
nmap -oG output.gnmap target.com       # grepable
nmap -oA output target.com             # all three formats

Timing Templates

nmap -T0  # Paranoid  — slowest, most stealthy
nmap -T1  # Sneaky    — slow, avoids IDS
nmap -T2  # Polite    — slow, reduces bandwidth
nmap -T3  # Normal    — default
nmap -T4  # Aggressive — faster, may miss on slow nets
nmap -T5  # Insane    — fastest, inaccurate on slow nets

Service Enumeration

SMB Enumeration

# List shares
smbclient -L //target.com -N           # no password (null session)
smbclient -L //target.com -U guest

# Connect to share
smbclient //target.com/SHARE -N
# smb: \> ls
# smb: \> get filename

# Enum4linux — comprehensive SMB/LDAP enumeration
enum4linux -a target.com
# Lists: users, groups, shares, OS info, password policy

# Nmap SMB scripts
nmap --script smb-enum-users,smb-enum-shares target.com
nmap --script smb-vuln-ms17-010 target.com  # EternalBlue check

FTP Enumeration

# Test anonymous login
nmap --script ftp-anon target.com
ftp target.com
# Username: anonymous   Password: (blank or email)

# FTP banner grabbing
nc target.com 21
# 220 ProFTPD 1.3.5 Server (ProFTPD Default Installation)

# Hydra brute force (if authorized)
hydra -l admin -P /usr/share/wordlists/rockyou.txt ftp://target.com

SNMP Enumeration

# SNMP uses UDP 161 — often forgotten, reveals lots of info
# Default community strings: public, private

# snmpwalk — walk the MIB tree
snmpwalk -v2c -c public target.com
# Reveals: hostname, OS, running processes, users, network interfaces

# Common OIDs
snmpwalk -v2c -c public target.com 1.3.6.1.2.1.25.4.2  # processes
snmpwalk -v2c -c public target.com 1.3.6.1.2.1.1.1     # system description
snmpwalk -v2c -c public target.com 1.3.6.1.4.1.77.1.2.25  # Windows users

# onesixtyone — SNMP community string brute force
onesixtyone -c /usr/share/seclists/Discovery/SNMP/snmp.txt target.com

HTTP Enumeration

# Nikto — web server vulnerability scanner
nikto -h https://target.com

# Gobuster — directory/file brute force
gobuster dir -u https://target.com -w /usr/share/seclists/Discovery/Web-Content/common.txt
gobuster dir -u https://target.com -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,txt,bak

# ffuf — faster web fuzzer
ffuf -u https://target.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt
ffuf -u https://target.com/FUZZ -w wordlist.txt -fc 404  # filter 404s

# Subdomain brute force
gobuster dns -d target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

Vulnerability Scanning

Nessus

Tenable Nessus — industry standard vulnerability scanner:
1. Install Nessus (free for home use: Nessus Essentials)
2. Activate at localhost:8834
3. Create scan:
   - New Scan → Basic Network Scan
   - Target: 192.168.1.0/24
   - Run scan
4. Review findings:
   - Critical (red): patch immediately
   - High (orange): patch soon
   - Medium (yellow): plan patching
   - Info (blue): informational
5. Export: PDF, CSV, HTML report

OpenVAS

# Free open-source alternative to Nessus
# Install on Kali:
apt install openvas
gvm-setup
gvm-start

# Web interface at https://localhost:9392
# Create target, run scan, review findings

Interpreting Results

Priority order for exploitation:
1. Remote code execution (RCE) vulnerabilities — highest priority
2. Authentication bypass
3. SQLi, XSS in admin areas
4. Information disclosure
5. Medium-severity misconfigurations

CVSSv3 Score → Severity:
9.0–10.0 Critical
7.0–8.9  High
4.0–6.9  Medium
0.1–3.9  Low

Scan a local VM or a lab target (TryHackMe/HackTheBox machine): (1) host discovery with -sn on /24 subnet, (2) full port scan with -p- -sV, (3) run -A for OS detection, (4) use NSE scripts: smb-enum-shares, http-title, ftp-anon, (5) save output in all three formats (-oA), (6) build a service inventory: service name, version, port, potential vulnerabilities.

✦ Answer the questions to complete this task

What does the -sV flag do in Nmap?

Why is UDP scanning important despite being slow?

On a lab target with SMB/SNMP enabled: (1) use enum4linux -a to enumerate users, shares, OS, password policy, (2) attempt null session: smbclient -L //target -N, (3) connect to readable shares and list files, (4) use snmpwalk with community string 'public' to list running processes and users, (5) use onesixtyone to brute-force SNMP community strings.

✦ Answer the questions to complete this task

What is a null session in SMB?

On a web target: (1) run gobuster with common.txt wordlist, (2) run ffuf with file extension fuzzing: -x php,html,txt,bak, (3) find hidden admin pages, backup files, and configuration files, (4) run Nikto and identify outdated headers and missing security headers, (5) identify the most critical finding and explain how it would be exploited.

✦ Answer the questions to complete this task

What does Gobuster's -x flag do?