Skip to main content

Week 4 — Active reconnaissance and network scanning

Learning objectives​

  • Use Nmap thoughtfully: every option has a cost in noise and time.
  • Enumerate exposed Windows services with Enum4Linux.
  • Understand what actually goes over the wire with Wireshark and Scapy.

Nmap — The foundation​

# Fast sweep, top-1000 ports, OS and service detection.
sudo nmap -sS -sV -O -T3 -oA scans/fast 10.0.0.0/24

# Full TCP scan, slower, more complete.
sudo nmap -p- -sS -sV --min-rate 1000 -oA scans/full 10.0.0.15

# Targeted discovery scripts (never all scripts at once).
sudo nmap -sV --script "safe and not intrusive" -p 80,443 10.0.0.15

Three settings to understand before automating:

  • -T: the timing template. On a noisy pentest, T3 stays reasonable. T4/T5 break fragile services.
  • --min-rate: enforces a minimum throughput. Useful on large fleets, dangerous on old hardware.
  • -Pn: skips host discovery. Only when you know the target is alive but blocks ICMP.

Windows / Samba enumeration​

enum4linux-ng -A 10.0.0.20
smbclient -L //10.0.0.20/ -N

What you look for: shares accessible with a null session, enumerable accounts, password policy, domain membership.

Wireshark and Scapy​

Wireshark is for understanding, Scapy for crafting. In a pentest, you use Wireshark to verify what a scan really produces on the wire; you use Scapy to forge a packet Nmap could not produce.

from scapy.all import IP, TCP, sr1

# A hand-crafted SYN, to observe the response.
packet = IP(dst="10.0.0.15") / TCP(dport=8080, flags="S")
response = sr1(packet, timeout=2, verbose=0)
print(response.summary() if response else "no response")

Lab 1 kick-off​

Lab 1 starts this week. Goal: produce a complete map of a lab network provided (download from the virtual classroom). Deliverable expected in week 6.

  • A map of the live hosts (.md + screenshot).
  • An inventory of the services per host, versions included.
  • Three prioritized attack hypotheses, to be confirmed later.