Step 113. Reconnaissance 1: A Complete Survey of the Target’s Services — Attacks Begin with Building a List

Level 2 — Introduction to Security and the Basics of Attack Skills | Difficulty ★★★☆☆ | Estimated time: 3 hours

Prerequisites: Step 81 (Mastering nmap) complete. Step 112’s isolated lab (Kali + Metasploitable2) is finished, and you know MS2’s lab IP.

What you need: a Kali VM (or any Linux with nmap), a booted MS2, and one file for your reconnaissance notes.
Caution: ⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime. Today’s scan targets are strictly the MS2 in your lab and your own computer (127.0.0.1). In this chapter, MS2-targeted output is marked as a "Screen example"; 127.0.0.1-targeted output was measured on WSL (Nmap 7.94SVN) on 2026-09-09.

The first real action of a penetration test is not an attack — it is building a list. Finding out, without omission, how many doors are open on the target server and what lies behind each one — that is reconnaissance. In Step 81 you learned nmap’s principles against your own computer; now you aim at a real target. MS2 is a target born for reconnaissance practice, with more than twenty ports open.

1. Learning Objectives

By the end of this chapter, you will be able to:

Explain what the attack surface is and enumerate it with a full scan
Combine nmap -p- with -sV -sC to build an inventory of the target’s services and versions
Read service banners from nmap output and understand that "version = vulnerability index"
Look at unusual ports (512/513/514, 1524, 6667, and so on) and set investigation priorities
Save scan results to an -oN file to create a reproducible reconnaissance record

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	nmap 7.9x on Kali (or WSL) + MS2 in the isolated lab
Today’s commands	`nmap -p- -T4 target` (full scan), `nmap -sV -sC -p portlist target -oN file` (versions + scripts + saving), `ss -tlnp` (identify the owner of your own ports)
Concepts needed	Attack surface, banners, service inventory, all the scan options from Step 81
Today’s artifact	An MS2 service inventory document (port \| service \| version \| role \| vulnerability candidate)

2-1. The Attack Surface — The Sum of Open Doors

The attack surface is the sum total of contact points an attacker can reach. From a network-service perspective, one open port = one contact point. A server with 20 open ports is exposing 20 different conversation partners, and each conversation partner (service program) has its own history and known weaknesses.

The goal of reconnaissance is to enumerate this surface completely and accurately. "Completely" is -p- (the full scan); "accurately" is -sV (version detection). Doing only one of the two leaves you with half a picture — the default scan misses things, and port numbers alone don’t reveal the real thing.

2-2. Reading Banners — A Version Is an Index

What appears in the VERSION column of -sV output is the ID card a service voluntarily shows — its banner. For example, the five letters of vsftpd 2.3.4 are not just a name — they are an index that returns immediate results when searched in a vulnerability database.

An attacker’s train of thought goes like this:

Port open → identify the service → identify the version → "known vulnerabilities of this version?" → choose an attack

Today we complete the first three boxes of this flow. The fourth box — matching versions against vulnerabilities — is a separate skill, covered in the next stage of reconnaissance.

2-3. When the Full Scan Is Slow — -T4

Because -p- checks 65,535 ports, it takes time against a remote target. -T4 raises nmap’s speed grade (0–5), and it is the standard choice on a trustworthy lab network. Be aware, though: raising the speed makes packets more aggressive, leaves vivid traces in the target’s logs, and on a congested network can actually cause misses — this is a lab option, not something to apply wholesale in real-world reconnaissance.

3. Follow Along

3-1. Warm-Up — A Full Scan of Your Own Computer

Before knocking on MS2, warm up with a full scan of your own computer (a Linux terminal — WSL works).

Input

nmap -p- 127.0.0.1

Output (measured 2026-09-09):

Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-09-09 15:09 KST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.0000010s latency).
Not shown: 65533 closed tcp ports (reset)
PORT      STATE SERVICE
8000/tcp  open  http-alt
43467/tcp open  unknown

Nmap done: 1 IP address (1 host up) scanned in 0.32 seconds

How to read it: 65,535 ports checked in 0.32 seconds — loopback answers instantly, so it’s fast. This computer has the well-known port 8000 (the simple web server from a previous exercise) open, plus port 43467, which sat outside the default scan’s field of view (1000 ports). The value of a full scan — discovering "open doors I didn’t know about" — is right here.

3-2. Warm-Up 2 — Reading Banners

Let’s confirm the identity of the open ports. Open one more practice server to enlarge the target.

Input

python3 -m http.server 8888 &   # add a practice server (occupies one terminal)
nmap -sV -sC -p 8000,8888 127.0.0.1

Output (measured 2026-09-09):

PORT     STATE SERVICE VERSION
8000/tcp open  http    SimpleHTTPServer 0.6 (Python 3.12.3)
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: SimpleHTTP/0.6 Python/3.12.3
8888/tcp open  http    SimpleHTTPServer 0.6 (Python 3.12.3)
|_http-title: Directory listing for /
|_http-server-header: SimpleHTTP/0.6 Python/3.12.3

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.28 seconds

How to read it: -sV filled the VERSION column with the real thing, and -sC (the default script bundle) dug up extra information on lines starting with |_ — the server header and page titles. This is what "banner reading" actually looks like. Remember the moment when the default scan’s http-alt (a guess from the number table) is replaced by SimpleHTTPServer 0.6 (Python 3.12.3) (a confirmed identity).

3-3. Finding the Owner of unknown — ss

For a port that even banners won’t identify, you look up its owner from inside the server (a privilege available because this is your own computer).

Input

ss -tlnp | grep 43467

Output (measured 2026-09-09):

LISTEN 0 4096 127.0.0.1:43467 0.0.0.0:* users:(("containerd",pid=216,fd=14))

How to read it: ss -tlnp shows "listening (t, l) TCP ports, as numbers (n), together with program names (p)." The owner of port 43467 was the container management program (containerd). On an attack-target server you can’t use this command (you haven’t logged in yet), so you must deduce from banners and fingerprints — but when inspecting your own equipment, this single line is the fastest correct answer.

3-4. The Main Event — A Full Scan of MS2

Now knock on the lab’s target. From a Kali terminal — 192.168.56.101 is an example; use your MS2 lab IP (the one you noted in Step 112).

Input (Kali)

nmap -p- -T4 192.168.56.101

Screen example (not run — the authoring environment has no MS2; this is MS2’s publicly documented standard result. Replace it with your own output and compare):

Nmap scan report for 192.168.56.101
Host is up (0.0010s latency).
Not shown: 65505 closed tcp ports (reset)
PORT      STATE SERVICE
21/tcp    open  ftp
22/tcp    open  ssh
23/tcp    open  telnet
25/tcp    open  smtp
53/tcp    open  domain
80/tcp    open  http
111/tcp   open  rpcbind
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
512/tcp   open  exec
513/tcp   open  login
514/tcp   open  shell
1099/tcp  open  java-rmi
1524/tcp  open  bindshell
2049/tcp  open  nfs
2121/tcp  open  ccproxy-ftp
3306/tcp  open  mysql
5432/tcp  open  postgresql
5900/tcp  open  vnc
6000/tcp  open  X11
6667/tcp  open  irc
8009/tcp  open  ajp13
8180/tcp  open  unknown

How to read it: twenty-three open doors. Considering that a normal server has only a few open ports, this list itself is a sign saying "this server is for practice." If the count and list differ in your output, suspect the MS2’s state or the network (Wall 2 in section 6).

3-5. Version Detection + Recording — The Artifact of Reconnaissance

Now confirm each port’s identity while saving it to a file.

Input (Kali)

nmap -sV -sC -p 21,22,23,25,53,80,111,139,445,512,513,514,1099,1524,2049,2121,3306,5432,5900,6000,6667,8009,8180 -oN ms2_scan.txt 192.168.56.101

Screen example (not run — MS2 standard result, excerpt):

PORT    STATE SERVICE     VERSION
21/tcp  open  ftp         vsftpd 2.3.4
22/tcp  open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
23/tcp  open  telnet      Linux telnetd
25/tcp  open  smtp        Postfix smtpd
80/tcp  open  http        Apache httpd 2.2.8 ((Ubuntu) DAV/2)
|_http-server-header: Apache/2.2.8 (Ubuntu) DAV/2
139/tcp open  netbios-ssn Samba smbd 3.0.20-Debian (workgroup: WORKGROUP)
512/tcp open  exec        netkit-rsh rexecd
1524/tcp open  bindshell  Metasploitable root shell
3306/tcp open  mysql      MySQL 5.0.51a-3ubuntu5
6667/tcp open  irc        UnrealIRCd
8180/tcp open  http       Apache Tomcat/Coyote JSP engine 1.1
|_http-title: Apache Tomcat/5.5

How to read it: the list has now changed from "port numbers" to "identities." vsftpd 2.3.4, OpenSSH 4.7p1, Samba 3.0.20, MySQL 5.0.51a — all old versions where you can feel the years, and that is the intended design. And notice port 1524’s banner, Metasploitable root shell, as if the target itself were saying "I’m open right here." The first line of the saved ms2_scan.txt automatically records the scan date/time and the full command (review Step 81).

3-6. Writing the Inventory Document — Turning Output into Knowledge

Scan output is data, not knowledge. The last step that turns it into knowledge — organize it into a table. Create a notes file (ms2_inventory.md) and fill it in with this format:

Port	Service	Version	Role	Vulnerability candidate
21	ftp	vsftpd 2.3.4	File transfer	○ (this version is notorious)
22	ssh	OpenSSH 4.7p1	Remote access	△ (old)
23	telnet	Linux telnetd	Remote access (plaintext!)	○
512/513/514	rlogin/rsh	netkit-rsh	Ancient remote access	○
3306	mysql	5.0.51a	Database	△
6667	irc	UnrealIRCd	Chat server	○
8180	http	Tomcat 5.5	Java web server	○
…

How to read it: fill the "Role" column by researching services you don’t know — vsftpd‘s ftp is file transfer (File Transfer Protocol), samba is file sharing with Windows, tomcat is a Java web application server, and so on. The "Vulnerability candidate" column is still an unresearched prediction, so just mark it with ○/△ — confirmation is the next stage’s job.

Why: this table is the operations map you will keep unfolding throughout this lab. Each row will become an attack target and a defense checklist item in upcoming exercises.

4. Missions & Exercises

Mission — Complete the MS2 Service Inventory

Run a full scan with nmap -p- -T4 MS2_IP and record the count of open ports.
Run nmap -sV -sC -p (list) -oN ms2_scan.txt MS2_IP against every port found.
Write an inventory of all open ports in the table format from 3-6 — no rows may be missing.
While filling the "Role" column, research at least 3 services you don’t know and attach a one-line explanation to each.
At the end of the inventory, write "the one service I want to investigate first, and why."
Quote the first line of ms2_scan.txt (scan date/time + full command) at the top of the inventory.

How to verify it yourself: number of table rows = number of open ports from the full scan. If they match, it’s complete.

Exercises

Exercise 1. Using the measurement in 3-1 as evidence, explain why reconnaissance ends not with the default scan (1000 ports) but with a -p- full scan.

Exercise 2. Between the SERVICE column’s http-alt in nmap output and -sV output’s SimpleHTTPServer 0.6 (Python 3.12.3), which is the "real thing," and what is the basis of each?

Exercise 3. On an attack-target server you cannot use ss -tlnp, but on your own computer you can. What does this difference tell you about "the position of reconnaissance"?

Exercise 4. Explain why MS2’s ports 512/513/514 (exec/login/shell, the r-services) are peculiar from a security perspective, connecting it to the assumptions of the era in which these services were created.

5. Model Answers & Completion Criteria

Mission Model Answer

Order of execution (for format reference — use the IP and port count from your own environment):

nmap -p- -T4 192.168.56.101
# → 23 open ports (in the example environment)
nmap -sV -sC -p 21,22,23,...,8180 -oN ms2_scan.txt 192.168.56.101

Inventory example (excerpt — the full version must include every open port):

# MS2 Service Inventory
Scan record: # Nmap 7.95 scan initiated ... as: nmap -sV -sC -p ... -oN ms2_scan.txt 192.168.56.101

| Port | Service | Version | Role | Vulnerability candidate |
| 21 | ftp | vsftpd 2.3.4 | File transfer | ○ — research confirms this version had a backdoor incident |
| 23 | telnet | Linux telnetd | Plaintext remote access | ○ — the absence of encryption is itself a weakness |
| 6667 | irc | UnrealIRCd | Internet chat server | ○ — top investigation priority |

Top investigation target: port 1524 bindshell — its banner declares its own
identity as "Metasploitable root shell," making it the most likely
authentication-free door.

How to verify: ① Does the table’s row count match the full-scan result? ② Does the ms2_scan.txt file exist, with the full command on its first line? ③ Are there no blanks in the "Role" column? ④ Does the top target come with a reason?

Exercise Answers

Answer 1. The default scan looks only at the 1000 well-known ports, so it misses open doors beyond them. In the 3-1 measurement, port 43467 was outside the 1000-port list, so it didn’t appear in the default scan and was discovered only with -p-. Attackers look for services hiding on unconventional ports, and defenders must also find "open doors I didn’t know about" — so reconnaissance finishes with a full scan.

Answer 2. The latter is the real thing. http-alt is merely a conventional guess from the port number (a lookup in the number table), not an actual verification, whereas SimpleHTTPServer 0.6 is the result of -sV actually connecting and analyzing the banner and responses. A guess is "probably"; a verification is "grounded" — reports use the latter.

Answer 3. ss is a command only someone logged into the server can use. Reconnaissance is the stage where you deduce the interior using only information obtainable from outside, before login (open ports, banners, the shape of responses). That’s why reconnaissance output always mixes "certain" with "estimated," and why you need a critical eye for readings like unknown or "guess." Conversely, when inspecting your own equipment, you can instantly verify outside guesses with an inside command (ss).

Answer 4. The r-services (rlogin/rsh/rexec) are a design from the era when the internet was still a gentlemen’s network — "trusted hosts come in without a password." Host-based trust collapses with a single act of IP spoofing, transmissions are plaintext, and by modern standards their very existence is a vulnerability. That is also why they were planted in MS2 — if these ports are open on a modern server, that alone becomes an item in an audit report.

Completion Criteria Checklist

[ ] I practiced a full scan of my own computer with nmap -p- 127.0.0.1
[ ] I can explain how the VERSION column of -sV differs from the default scan’s guess
[ ] I identified the owner program of an open port with ss -tlnp
[ ] I ran a full scan of MS2 with nmap -p- -T4
[ ] I performed version detection and left a record with -sV -sC ... -oN ms2_scan.txt
[ ] I completed an inventory table containing every open port
[ ] I researched the roles of at least 3 services I didn’t know
[ ] Mission: I completed the MS2 service inventory document

6. Common Pitfalls & Fixes

Wall 1. The MS2 scan is endlessly slow

Symptom: the -p- scan hasn’t finished after several minutes.
Cause: you’re checking 65,535 ports at default speed without -T4, or the VM lacks resources. Unlike loopback (measured at 0.32 seconds), a full scan of a remote target normally takes tens of seconds to a few minutes.
Fix: add -T4. If it’s still slow, check the memory status of MS2 and Kali, and consider whether a firewall is silently dropping packets in between — ports with no response are waited on for the full timeout, so filtering slows things down sharply.

Wall 2. My MS2 scan results differ from the book (fewer ports appear)

Symptom: only a few ports are open — or none at all — instead of twenty.
Possible causes: ① MS2 is off or still booting. ② Wrong IP — you’re scanning a different machine. ③ Network miss — a problem with Kali’s host-only adapter.
Fix: first check liveness with ping MS2_IP, and confirm with ip a on Kali that a host-only subnet address is assigned. And verify that the IP you scanned really is MS2 — as cautioned in 3-4, check that you didn’t type the example IP verbatim.

Wall 3. The version shows as ? or unknown

Symptom (Screen example): the VERSION column is empty, or 1 service unrecognized despite returning data appears.
Cause: the response shape isn’t in nmap’s database. In the 2026-09-09 measurement, port 43467 was in exactly this state.
Fix: three responses — ① retry with --version-intensity 9 to raise the probe intensity. ② Read the response sample in the output’s fingerprint and deduce it yourself (the measured fingerprint showed HTTP/1.0 404 Not Found, revealing "an HTTP-like service"). ③ If it’s your own equipment, identify the owner directly with ss -tlnp. "I don’t know" is also an honest reconnaissance result — don’t write a guess as if it were a confirmation.

Wall 4. The scan says Host seems down

Symptom (Screen example): MS2 is clearly on, but it reports "seems to be down."
Cause: either only nmap’s liveness check (ping) is blocked, or the network really is disconnected.
Fix: try adding -Pn (skip liveness check). If that doesn’t work, it’s a network problem — go back to Wall 2’s procedure.

Wall 5. I look at scan results only in the terminal without saving them to a file

Symptom: you closed the terminal and the scan results vanished.
Cause: you left out -oN. Screen output is volatile.
Fix: make "always attach -oN filename to a reconnaissance command" a finger reflex. The first line of a saved file automatically records the scan date/time and the full command — a "reproducible record" comes for free. Rescanning takes minutes; saving a file takes 0 seconds.

7. Summary

Today’s Concepts

Concept	One-line explanation
Reconnaissance	The first step common to attack and defense — identifying a target’s open doors without omission
Attack surface	The sum total of contact points an attacker can reach — the list of open ports
Banner	The ID card a service voluntarily shows — a version is an index into vulnerabilities
Service inventory	A table organizing ports, services, versions, and roles — the true artifact of reconnaissance
Guess vs. real thing	The SERVICE column (number-table guess) vs. the `-sV` result (confirmed identity)
-T4	A grade that raises scan speed on a trusted lab network — no abuse in real work

Today’s Commands

Command	What it does
`nmap -p- -T4 target`	Full scan of all 65,535 ports (without omission)
`nmap -sV -sC -p list target`	Confirm services and versions + default scripts (accurately)
`nmap ... -oN file`	Save a reproducible record with the full command written in
`nmap --version-intensity 9`	Maximum probe intensity for finicky services
`ss -tlnp`	Identify the owner program of open ports on your own equipment
`nmap -Pn target`	Skip the liveness check (for targets where ping is blocked)

An Instinct More Important Than Commands

Today you wrote the first page of an attack. And that page was not attack code — it was a table. The difference between a skilled penetration tester and a script kiddie splits right at this stage — the latter looks for exploits first; the former builds an inventory first. An attack without a list is gambling; an attack with a list is a plan.

One more thing — look at today’s inventory again through a defender’s eyes. The sentence "a port with no reason to be open is open" is a list of opportunities to an attacker, but on a server you manage, it’s an audit finding. The same table creates two professions. That is the real reason to learn reconnaissance.

Once every box is checked, Step 113 is complete. Click the checkbox in the sidebar to save your progress.