Active-Reconnaissance Lab

View this project on GitHub

This lab outlines performing host discovery, port scanning, service version detection, and vulnerability scanning and detection using Nmap. The lab was conducted in a controlled environment to demonstrate various reconnaissance techniques.

Table of Contents

• Introduction
• Host Discovery
  • Nmap Host Discovery
  • ARP Scan
  • FPing
  • Passive Reconnaissance with Wireshark
  • Screenshots
• Port Scanning and Host Fingerprinting
  • Nmap Port Scanning
  • Nmap Service Version Detection
  • Screenshots
  • Web Server Enumeration on Port 80
  • Screenshots
• Fingerprinting with Nmap Scripts
  • FTP Enumeration
  • SSH Enumeration
  • SMB Enumeration
  • Web Server Enumeration
• Acknowledgments

Introduction

This document contains step-by-step guides for performing active reconnaissance using Nmap and other tools. It covers host discovery, port scanning, service version detection, and web server enumeration. All activity was performed in a virtualized contained environment with three VMs. In this example, arp-scan, nmap, and fping are all utilized to perform network host discovery while the host fingerprinting stage primarily focuses on a Metasploitable2 VM.

Host Discovery

ARP-Scan, Nmap Ping Scan, and fping ping sweep

Perform an arp scan, nmap ping scan, and an fping scan to discover what hosts are connected to the local network.

Port Scanning and Host Fingerprinting

SYN scan and service version detection

Full port scan and service version detection

SYN scan, service version detection, and UDP scan

Port scan for ports 1-10000 and service version detection:

Fingerprinting with Nmap Scripts

Use Nmap scripts to fingerprint services and gather detailed information.

FTP Enumeration

SSH Enumeration

SMB Enumeration

Web Server Enumeration

Acknowledgments

Metasploitable2

Metasploitable2 is a vulnerable virtual machine intended for use as a target for testing security tools and demonstrating common vulnerabilities.

Official download page: https://sourceforge.net/projects/metasploitable/

License: BSD License, GNU General Public License version 2.0 (GLPv2)