Phase 02 · Mapping the Surface

Scanning & Enumeration

Recon told you the target exists. Scanning tells you exactly what it is running. This phase moves from passive observation to active probing — finding live hosts, open ports, and the precise service and version behind each one. Every later phase is only as good as the inventory you build here.

00

About this phase

Enumeration is the bridge between "there is a host at this address" and "there is an outdated version of a specific service on this port." Nmap is the workhorse: host discovery, a spectrum of port-scan techniques, service and version detection, OS fingerprinting, and a scripting engine for deeper probing. The output is a structured map of the attack surface that vulnerability analysis and exploitation depend on.

This phase reuses the Port Scanning Lab from Network Security — the same six scan techniques, now framed as a step in a live engagement.

Lessons

3 + lab

Phase

02 of 08

Status

Complete

01

Lessons & labs in this phase

02.01

Finding which addresses are alive — ARP, ICMP, and TCP/UDP ping sweeps, and when each is appropriate.

Port Scanning with Nmap

Connect, SYN, FIN, Xmas, and UDP scans — how each works at the packet level and what its results mean.

Service & Version Enumeration

Banner grabbing, version detection, OS fingerprinting, and the Nmap Scripting Engine (NSE).

Nmap Scan Builder

Compose a scan flag-by-flag and see the command, a plain-English explanation of each switch, and a simulated result that changes with your choices.

Port Scanning Lab

Six scan techniques against three scenarios. Live lab in Network Security.

Watch a scan unfold packet by packet. Live in Network Security.