search

Port Scanning 2

Before studying this material, it is recommended to read previous.

So, in this article, we will understand what we need to do after finding open ports on the host.

First, when we find any open port, we need to find out what service and what version of it is located there;

Before using nmap, you can use the banner-grabbingarrow-up-right technique, where we get a service banner simply by connecting to it via a port, for example, using netcat:

╰─ nc 10.129.30.147 22                     
SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.2

As you can see, we caught a service banner that told us what kind of service it was and what version it was. By the way, nmap does almost the same thing.

nmap has the -sV flag to determine the service version:

╰─ nmap -p 22,80 -v -sV 10.129.30.147
Starting Nmap 7.95 ( https://nmap.org ) at 2026-01-02 20:26 EST
NSE: Loaded 47 scripts for scanning.
Initiating Ping Scan at 20:26
Scanning 10.129.30.147 [4 ports]
Completed Ping Scan at 20:26, 0.11s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 20:26
Completed Parallel DNS resolution of 1 host. at 20:27, 5.51s elapsed
Initiating SYN Stealth Scan at 20:27
Scanning 10.129.30.147 [2 ports]
Discovered open port 80/tcp on 10.129.30.147
Discovered open port 22/tcp on 10.129.30.147
Completed SYN Stealth Scan at 20:27, 0.23s elapsed (2 total ports)
Initiating Service scan at 20:27
Scanning 2 services on 10.129.30.147
Completed Service scan at 20:27, 6.27s elapsed (2 services on 1 host)
NSE: Script scanning 10.129.30.147.
Initiating NSE at 20:27
Completed NSE at 20:27, 0.81s elapsed
Initiating NSE at 20:27
Completed NSE at 20:27, 0.83s elapsed
Nmap scan report for 10.129.30.147
Host is up (0.11s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Gunicorn
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 14.03 seconds
           Raw packets sent: 6 (240B) | Rcvd: 3 (116B)

Okay, we've got the services and their versions, now we can use NSEarrow-up-right scripts, which will give us more information about the services, do enumeration, and search for vulnerabilities.

nmap has a -sC flag that runs a set of standard scripts:

Keep in mind that most of the vulnerabilities found may simply not work, and don't forget that such scans with special scripts create quite a lot of noise.

If we want to specify which scripts we want to use, we need to specify the --script flag and the name of the scripts separated by commas, for example, I want to use a script that scans for vulnerabilities:

A complete list of scripts and what they do can be found herearrow-up-right.

We can also use online services like Shodanarrow-up-right and Censysarrow-up-right for passive information collection. The downside is that they don't scan in real time, but only show the latest scan results. They will show the ports they found, as well as the services and their vulnerabilities.

Example search in Shodan:

Example search in Censys:

Thanks for reading!

This page is not completely finished yet, and will be updated.

PreviousPort ScanningNextSNMP

Last updated