Perform active network reconnaissance against an isolated lab environment using industry-standard tools to identify live hosts, enumerate open ports, and fingerprint running services.
| Component | Details |
|---|---|
| Attacker | Kali Linux |
| Target | Metasploitable 2 |
| Network | Host-Only (192.168.56.0/24) |
| Target IP | 192.168.56.102 |
| Tool | Purpose |
|---|---|
nmap |
Port scanning, service version detection, OS fingerprinting, and NSE scripting |
netdiscover |
ARP-based host discovery across the local network segment |
The recon-scan.sh script automates the full reconnaissance workflow and can be run against any target with a single command.
- Host discovery with Netdiscover to confirm live hosts using ARP
- SYN scan with Nmap to identify open TCP ports without completing full handshakes
- Full port scan across all 65535 ports to catch services on non-standard ports
- Service and version detection to fingerprint exact software on each open port
- OS detection to identify the underlying operating system
- NSE default scripts to pull banners, enumerate shares, and run safe automated checks
Host discovery was performed across the full host-only subnet:
sudo netdiscover -r 192.168.56.0/24 -i eth1Metasploitable 2 responded at 192.168.56.102, confirming the target was live before any port scanning began.
Output Results: scan-results/netdiscover_output.txt
The primary comprehensive scan was run using:
nmap -sV -sC -O 192.168.56.102Full output is saved in scan-results/nmap_full_output.txt.
| Scan Type | Command | Output File |
|---|---|---|
| Ping Sweep | sudo nmap -sn 192.168.56.0/24 |
scan-results/ping_sweep.txt |
| Full Port Scan | sudo nmap -sV -p- 192.168.56.102 |
scan-results/full_port_scan.txt |
| OS Detection | sudo nmap -O 192.168.56.102 |
scan-results/os_detection.txt |
| NSE Default Scripts | sudo nmap -sC 192.168.56.102 |
scan-results/nmap_scripts.txt |
| Aggressive Scan | sudo nmap -A 192.168.56.102 |
scan-results/aggressive_scan.txt |
| Port | Protocol | Service | Version | Notes |
|---|---|---|---|---|
| 21 | TCP | FTP | vsftpd 2.3.4 | Backdoor vulnerability - CVE-2011-2523 |
| 22 | TCP | SSH | OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0) | Old version, weak algorithms |
| 23 | TCP | Telnet | Linux telnetd | Cleartext protocol, no encryption |
| 25 | TCP | SMTP | Postfix smtpd | Mail server exposed |
| 53 | TCP | DNS | ISC BIND 9.4.2 | Old version, potential zone transfer vulnerability |
| 80 | TCP | HTTP | Apache httpd 2.2.8 (Ubuntu) DAV/2 | Web server, old version, WebDAV enabled |
| 111 | TCP | RPCBind | 2 (RPC #100000) | RPC portmapper, enables NFS enumeration |
| 139 | TCP | NetBIOS-SSN | Samba smbd 3.X - 4.X (workgroup: WORKGROUP) | SMB file sharing, multiple known vulnerabilities |
| 445 | TCP | NetBIOS-SSN | Samba smbd 3.X - 4.X (workgroup: WORKGROUP) | SMB over TCP, vulnerable to CVE-2007-2447 (usermap_script) |
| 512 | TCP | Exec | netkit-rsh rexecd | Legacy r-service, trust-based auth, no encryption |
| 513 | TCP | Login | Linux login service | Legacy r-service, .rhosts trust allows passwordless login |
| 514 | TCP | Shell | Netkit rshd | Legacy r-service, remote shell with no authentication |
| 1099 | TCP | Java RMI | GNU Classpath grmiregistry | RMI registry exposed, potential remote code execution |
| 1524 | TCP | Bindshell | Metasploitable root shell | Pre-planted root backdoor, no authentication required |
| 2049 | TCP | NFS | 2-4 (RPC #100003) | NFS shares exposed, misconfigured exports allow unauthorized mounts |
| 2121 | TCP | FTP | ProFTPD 1.3.1 | Second FTP server, known SQL injection and RCE vulnerabilities |
| 3306 | TCP | MySQL | MySQL 5.0.51a-3ubuntu5 | Database exposed on network |
| 3632 | TCP | distccd | distccd v1 (GNU 4.2.4 Ubuntu 4.2.4-1ubuntu4) | Remote code execution - CVE-2004-2687 |
| 5432 | TCP | PostgreSQL | PostgreSQL DB 8.3.0 - 8.3.7 | Database exposed on network |
| 5900 | TCP | VNC | VNC protocol 3.3 | Remote desktop exposed, old protocol version, weak authentication |
| 6000 | TCP | X11 | Access denied | X Window System exposed, no encryption, potential display hijacking |
| 6667 | TCP | IRC | UnrealIRCd | Backdoor vulnerability - CVE-2010-2075 |
| 6697 | TCP | IRC | UnrealIRCd | Same UnrealIRCd backdoor on SSL port - CVE-2010-2075 |
| 8009 | TCP | AJP13 | Apache Jserv Protocol v1.3 | AJP connector exposed, vulnerable to Ghostcat - CVE-2020-1938 |
| 8180 | TCP | HTTP | Apache Tomcat/Coyote JSP engine 1.1 | Tomcat Manager accessible with default credentials, allows WAR deployment |
| 8787 | TCP | DRb | Ruby DRb RMI (Ruby 1.8; path /usr/lib/ruby/1.8/drb) | Ruby distributed object protocol exposed, end-of-life runtime |
| 42026 | TCP | Status | 1 (RPC #100024) | RPC status service, supports NFS/RPC attack surface mapping |
| 52833 | TCP | NLockMgr | 1-4 (RPC #100021) | NFS lock manager, part of NFS service stack |
| 56231 | TCP | Mountd | 1-3 (RPC #100005) | NFS mount daemon, showmount reveals open exports |
| 59137 | TCP | Java RMI | GNU Classpath grmiregistry | Second RMI registry on ephemeral port, expands RMI attack surface |
For plain-English explanations of each finding, see FINDINGS.md.
- Running only a default Nmap scan would have missed several services running on non-standard ports. Always run a full port scan with
-p-before moving on to service detection. - Watching a SYN scan happen in Wireshark in real time made the theory from studying click in a way that reading alone never does. Seeing the SYN, SYN-ACK, and RST exchanges for open and closed ports is worth doing at least once.
- The recon-scan.sh script will carry into every future lab. Building automation early means nothing gets missed when targeting a new machine.