Scanning & Enumeration
Once you have identified a target, scanning reveals exactly what services, ports, and operating systems are running. You will master Nmap — the industry-standard scanner — and learn enumeration techniques to extract detailed service information. This phase transforms raw IP addresses into actionable attack surfaces.
Learning Objectives — Deep Dive
Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.
Verify Nmap installation and review scan types
Open a terminal in Kali and confirm Nmap is installed and up to date, then review the main scan types you will use: -sS (SYN scan, stealthy and fast, requires root), -sT (TCP connect scan, no root needed but slower and more detectable), -sU (UDP scan, slow but finds services like DNS and SNMP), and -sV (service version detection). Understanding when to use each scan type is critical — a SYN scan is appropriate for most situations, but a UDP scan is essential for finding services that only listen on UDP such as SNMP and DNS. The version flag (-sV) adds significant time to scans but is almost always worth it because knowing exact service versions is required for finding matching exploits in the next phase.
nmap --version && nmap -h | head -40Run a host discovery sweep before port scanning
Before scanning ports, identify which hosts are actually alive on the network using a ping sweep with the -sn flag, which disables port scanning and only performs host discovery using ICMP echo requests and TCP probes. Adjust the subnet to match your VirtualBox host-only network — run ip addr on Kali to find your host-only interface IP and subnet. A common mistake is scanning a large port range against an IP that is not even alive, wasting significant time and generating unnecessary noise. Save the list of live hosts to a file using -oG so you can reference it throughout the engagement without re-running the discovery scan.
ip addr && sudo nmap -sn 192.168.56.0/24 -oG live-hosts.txt && grep Up live-hosts.txtPerform a targeted SYN scan with service detection
Run a SYN scan against your Metasploitable target with service version detection enabled: -sS performs the half-open SYN scan (fastest and most common), -sV probes open ports to determine service versions, and -p 1-1000 scans the most common 1000 ports first to get quick results. Watch the output carefully — each open port shows the port number, state (open/closed/filtered), service name, and version string. The version string is critical: vsftpd 2.3.4 tells you exactly which exploit to look for in the next phase. A filtered port means a firewall is blocking the probe, which is different from closed (port exists but nothing is listening) and requires different techniques to investigate.
sudo nmap -sS -sV -p 1-1000 -oA targeted-scan 192.168.56.101Run a comprehensive full-port scan with OS detection
Now run a complete scan of all 65,535 ports with OS detection and script scanning enabled using the -A flag, which enables OS detection, version detection, script scanning, and traceroute in one convenient flag. The -p- flag scans all ports and takes significantly longer (10-30 minutes depending on the target), so run it in a background tmux pane while you investigate the initial scan results. Save output in all three formats using -oA: this creates .nmap (human-readable), .xml (machine-readable for import into Metasploit), and .gnmap (greppable) files simultaneously. A common mistake is only scanning the top 1000 ports and missing services running on non-standard ports — many real-world vulnerabilities are found on high-numbered ports that basic scans miss.
sudo nmap -A -p- -oA full-scan 192.168.56.101Use NSE scripts for targeted service enumeration
Nmap Script Engine (NSE) scripts automate specific checks against discovered services, and the --script=default flag runs safe, informational scripts automatically. For SMB services on port 445, run smb-enum-shares and smb-enum-users to list accessible shares and user accounts. For FTP on port 21, run ftp-anon to check if anonymous login is allowed — this is a common misconfiguration that gives immediate access to files. A critical pitfall: some NSE scripts are intrusive and can crash services or trigger IDS alerts, so always check the script category (safe, intrusive, exploit, brute) before running it on any system, and never run intrusive scripts without explicit authorization.
sudo nmap --script=smb-enum-shares,smb-enum-users -p 445 192.168.56.101 && sudo nmap --script=ftp-anon -p 21 192.168.56.101Analyze results and build a service inventory
Open your scan output files and create a service inventory table with these columns: port number, protocol, service name, version, and notes on potential vulnerabilities. Cross-reference version numbers against the National Vulnerability Database at nvd.nist.gov — search for the service name and version to find known CVEs with their CVSS scores. On Metasploitable, you should find vsftpd 2.3.4 (CVE-2011-2523, a backdoor), Samba 3.x (multiple critical vulnerabilities), and many other vulnerable services. Prioritize your attack vectors by severity (CVSS score) and exploitability (is there a public exploit with Excellent reliability?) — this prioritized list drives your exploitation phase.
cat full-scan.nmap && searchsploit --nmap full-scan.xml