Post cover image

November 2, 2026

N-Map- Enumeration Beginner to Intermediate

Imagine you are looking for a book in a library. You ask the librarian where to find it. If they simply say, “It’s in the library,” you…

By Vatansingh

61 min read

Imagine you are looking for a book in a library. You ask the librarian where to find it. If they simply say, "It's in the library," you still have to search through hundreds of books. But if they say, "It's in the computer science section, on the second shelf, next to the cybersecurity books," you can find it much faster and more easily.

Similarly, when scanning a target system, knowing that it is alive is not enough. We need more specific information, such as open ports, running services, and their versions, to understand the target better.

Most scanning tools use a timeout while waiting to receive a response from a service/port. If this service/port does not respond within a specific amount of time, the tool will mark it as closed, filtered, or unknown. In the last two cases, we will still be able to work with it. However, if a port is marked as closed and Nmap doesn't show it to us, we will be in a bad situation. This service/port may provide us with an opportunity to find a way to access the system. Therefore, this can cost us a lot of unnecessary time before we find it.

Introduction to Nmap

nmap is network mapping tool and its open source means no license need to use this tool its used for network pentesting written in c c++ python and lua its job to send raw packets to server to check which ports open and services running it's also capable to fingerprint os details dns and so onN map also offers scanning capabilities that can determine if packet filters, firewalls, or intrusion detection systems (IDS) are configured as needed.

Use Cases

The tool is one of the most used tools by network administrators and IT security specialists. It is used to:

  • Audit the security aspects of networks
  • Simulate penetration tests
  • Check firewall and IDS settings and configurations
  • Types of possible connections
  • Network mapping
  • Response analysis
  • Identify open ports
  • Vulnerability assessment as well.

Nmap Architecture

Nmap offers many different types of scans that can be used to obtain various results about our targets. Basically, Nmap can be divided into the following scanning techniques:

  • Host discovery
  • Port scanning
  • Service enumeration and detection
  • OS detection
  • Scriptable interaction with the target service (Nmap Scripting Engine)
-sS

This scan method -sS makes it possible to scan several thousand ports per second. The TCP-SYN scan sends one packet with the SYN flag and, therefore, never completes the three-way handshake, which results in not establishing a full TCP connection to the scanned port.

  • If our target sends a SYN-ACK flagged packet back to us, Nmap detects that the port is open.
  • If the target responds with an RST flagged packet, it is an indicator that the port is closed.
  • If Nmap does not receive a packet back, it will display it as filtered. Depending on the firewall configuration, certain packets may be dropped or ignored by the firewall.
oot@breachlock-Devereux:/home/breachlock# nmap -iL ips.txt -sS
Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-31 16:44 UTC
Nmap scan report for 10.204.0.1
Host is up (0.0015s latency).
Not shown: 997 closed ports
PORT     STATE    SERVICE
22/tcp   open     ssh
161/tcp  open     snmp
3389/tcp filtered ms-wbt-server
Nmap scan report for 10.204.0.3
Host is up (0.0011s latency).
Not shown: 997 closed ports
PORT     STATE    SERVICE
22/tcp   open     ssh
161/tcp  open     snmp
3389/tcp filtered ms-wbt-server

In this example, we can see that we have multiple different TCP ports open. In the first column, we see the number of the port. Then, in the second column, we see the service's status and then what kind of service it is.

Host Discovery

sudo nmap 10.129.2.0/24 -sn -oA tnet | grep for | cut -d" " -f5

Scanning Options Description 10.129.2.0/24 Target network range. -sn Disables port scanning. -oA tnet Stores the results in all formats starting with the name 'tnet'.

This scanning method works only if the firewalls of the hosts allow it. Otherwise, we can use other scanning techniques to find out if the hosts are active or not.

Scan IP List

sudo nmap -sn -oA tnet -iL hosts.lst | grep for | cut -d" " -f5

Scanning Options Description -sn Disables port scanning. -oA tnet Stores the results in all formats starting with the name 'tnet'. -iL Performs defined scans against targets in provided 'hosts.lst' list.

sudo nmap -sn -oA tnet 10.129.2.18-20| grep for | cut -d" " -f5

If these IP addresses are next to each other, we can also define the range in the respective octet.

Scan Single IP

┌──(kali㉿kali)-[~/Desktop]
└─$ nmap 103.69.196.105 -sn -oA host
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-01 11:47 +0530
Nmap scan report for l1.ifwcreations.com (103.69.196.105)
Host is up (0.00034s latency).
Nmap done: 1 IP address (1 host up) scanned in 1.91 seconds

Scanning Options Description 10.129.2.18 Performs defined scans against the target. -sn Disables port scanning. -oA host Stores the results in all formats starting with the name 'host'.

Now what happen we used -sn to disable ping scanning so here nmap automatically send ICMP request -Pe When such request silent we can expect ICMP reply if ping host is alive which was alive in our case that we can also monitor using — packet-trace but here the more intresting part is Nmap could send an ICMP echo request, it would send an ARP ping resulting in an ARP reply before sending icmp request

┌──(kali㉿kali)-[~/Desktop]
└─$ sudo nmap 103.69.196.105 -sn -oA host -PE --packet-trace
[sudo] password for kali:
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-01 11:52 +0530
SENT (0.0605s) ICMP [192.168.115.128 > 103.69.196.105 Echo request (type=8/code=0) id=57323 seq=0] IP [ttl=59 id=52094 iplen=28 ]
RCVD (0.1272s) ICMP [103.69.196.105 > 192.168.115.128 Echo reply (type=0/code=0) id=57323 seq=0] IP [ttl=128 id=16296 iplen=28 ]
NSOCK INFO [0.1680s] nsock_iod_new2(): nsock_iod_new (IOD #1)
NSOCK INFO [0.1680s] nsock_connect_udp(): UDP connection requested to 192.168.115.2:53 (IOD #1) EID 8
NSOCK INFO [0.1680s] nsock_trace_handler_callback(): Callback: CONNECT SUCCESS for EID 8 [192.168.115.2:53]
NSOCK INFO [0.1680s] nsock_read(): Read request from IOD #1 [192.168.115.2:53] (timeout: -1ms) EID 18
NSOCK INFO [0.1690s] nsock_write(): Write request for 45 bytes to IOD #1 EID 27 [192.168.115.2:53]
NSOCK INFO [0.1690s] nsock_trace_handler_callback(): Callback: WRITE SUCCESS for EID 27 [192.168.115.2:53]
NSOCK INFO [0.1750s] nsock_trace_handler_callback(): Callback: READ SUCCESS for EID 18 [192.168.115.2:53] (78 bytes): .Y...........105.196.69.103.in-addr.arpa..................l1.ifwcreations.com.
NSOCK INFO [0.1750s] nsock_read(): Read request from IOD #1 [192.168.115.2:53] (timeout: -1ms) EID 34
NSOCK INFO [0.1750s] nsock_iod_delete(): nsock_iod_delete (IOD #1)
NSOCK INFO [0.1750s] nevent_delete(): nevent_delete on event #34 (type READ)
Nmap scan report for l1.ifwcreations.com (103.69.196.105)
Host is up (0.067s latency).
Nmap done: 1 IP address (1 host up) scanned in 0.18 seconds

Now here as we can c the sent request and rcvd request both showing in ICMP the reason is very simple the ip we scanned was not a subnet ip and not in range it was standalone ip

Scanning Options Description 10.129.2.18 Performs defined scans against the target. -sn Disables port scanning. -oA host Stores the results in all formats starting with the name 'host'. -PE Performs the ping scan by using 'ICMP Echo requests' against the target. --packet-trace Shows all packets sent and received --reason Displays the reason for specific result.

Another way to determine why Nmap has our target marked as "alive" is with the "--reason" option.

┌──(kali㉿kali)-[~/Desktop]
└─$ sudo nmap 103.69.196.105 -sn -oA host -PE --packet-trace --disable-arp-ping
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-01 11:55 +0530
SENT (0.0370s) ICMP [192.168.115.128 > 103.69.196.105 Echo request (type=8/code=0) id=26413 seq=0] IP [ttl=48 id=48094 iplen=28 ]
RCVD (0.1102s) ICMP [103.69.196.105 > 192.168.115.128 Echo reply (type=0/code=0) id=26413 seq=0] IP [ttl=128 id=40738 iplen=28 ]
NSOCK INFO [0.1600s] nsock_iod_new2(): nsock_iod_new (IOD #1)
NSOCK INFO [0.1600s] nsock_connect_udp(): UDP connection requested to 192.168.115.2:53 (IOD #1) EID 8
NSOCK INFO [0.1600s] nsock_trace_handler_callback(): Callback: CONNECT SUCCESS for EID 8 [192.168.115.2:53]
NSOCK INFO [0.1600s] nsock_read(): Read request from IOD #1 [192.168.115.2:53] (timeout: -1ms) EID 18
NSOCK INFO [0.1600s] nsock_write(): Write request for 45 bytes to IOD #1 EID 27 [192.168.115.2:53]
NSOCK INFO [0.1610s] nsock_trace_handler_callback(): Callback: WRITE SUCCESS for EID 27 [192.168.115.2:53]
NSOCK INFO [0.1660s] nsock_trace_handler_callback(): Callback: READ SUCCESS for EID 18 [192.168.115.2:53] (78 bytes): .............105.196.69.103.in-addr.arpa..................l1.ifwcreations.com.
NSOCK INFO [0.1670s] nsock_read(): Read request from IOD #1 [192.168.115.2:53] (timeout: -1ms) EID 34
NSOCK INFO [0.1670s] nsock_iod_delete(): nsock_iod_delete (IOD #1)
NSOCK INFO [0.1670s] nevent_delete(): nevent_delete on event #34 (type READ)
Nmap scan report for l1.ifwcreations.com (103.69.196.105)
Host is up (0.073s latency).
Nmap done: 1 IP address (1 host up) scanned in 0.17 seconds

An ICMP echo request can help us determine if our target is alive and identify its system.

Host and Port Scanning

It's important to understand After confirming that the target is alive, we perform further scans to gather more information about the system, such as open ports, running services, their versions, and the operating system. For example, if a server responds to our ping, we use Nmap to identify which ports are open and what services are running on them. This helps us understand the target system and identify potential security weaknesses.

State Description open This indicates that the connection to the scanned port has been established. These connections can be TCP connections, UDP datagrams as well as SCTP associations. closed When the port is shown as closed, the TCP protocol indicates that the packet we received back contains an RST flag. This scanning method can also be used to determine if our target is alive or not. filtered Nmap cannot correctly identify whether the scanned port is open or closed because either no response is returned from the target for the port or we get an error code from the target. unfiltered This state of a port only occurs during the TCP-ACK scan and means that the port is accessible, but it cannot be determined whether it is open or closed. open\|filtered If we do not get a response for a specific port, Nmap will set it to that state. This indicates that a firewall or packet filter may protect the port. closed\|filtered This state only occurs in the IP ID idle scans and indicates that it was impossible to determine if the scanned port is closed or filtered by a firewall.

SCTP (Stream Control Transmission Protocol) is a transport-layer protocol used for communication between two systems over an IP network. In network penetration testing, SCTP is important because it is another transport protocol, just like TCP and UDP, that may be used by applications and services.

Pasted image 20261101121045.png

During network enumeration, you should not only look for TCP and UDP services. Some applications also use SCTP.

For example:

  • Telecom infrastructure
  • Mobile network signaling (SIGTRAN)
  • Diameter-based network communication
  • Certain high-availability applications

SCTP INIT scan:

sudo nmap -sY -p 2905 192.168.1.10

SCTP COOKIE-ECHO scan:

sudo nmap -sZ -p 2905 192.168.1.10

Remember: SCTP uses protocol number 132 in IP packets, whereas TCP uses 6 and UDP uses 17. in short SCTP is another way for systems to communicate over a network. During a penetration test, identifying SCTP services helps discover additional attack surfaces that ordinary TCP and UDP scans might miss.

Discovering Open TCP Ports

By default, Nmap scans the 1,000 most commonly used TCP ports. If you run Nmap as root (using sudo), it uses SYN Scan (-sS), but if you run it without root privileges, it uses TCP Connect Scan (-sT). You can also choose which ports to scan, such as specific ports (-p 22,80,443), a range of ports (-p 22-445), the top 10 commonly used ports (--top-ports 10), all 65,535 TCP ports (-p-), or the top 100 ports for a faster scan (-F).

# TCP SYN Scan
sudo nmap -sS 192.168.1.10
# TCP Connect Scan
sudo nmap -sT 192.168.1.10
# UDP Scan
sudo nmap -sU 192.168.1.10
# SCTP INIT Scan
sudo nmap -sY 192.168.1.10
# SCTP COOKIE-ECHO Scan
sudo nmap -sZ 192.168.1.10
# TCP ACK Scan
sudo nmap -sA 192.168.1.10
# TCP NULL Scan
sudo nmap -sN 192.168.1.10
# TCP FIN Scan
sudo nmap -sF 192.168.1.10
# TCP Xmas Scan
sudo nmap -sX 192.168.1.10
# TCP Window Scan
sudo nmap -sW 192.168.1.10
# TCP Maimon Scan
sudo nmap -sM 192.168.1.10
# IP Protocol Scan
sudo nmap -sO 192.168.1.10
──(kali㉿kali)-[~/Desktop]
└─$ sudo nmap 103.69.196.105 --top-ports=10
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-01 12:17 +0530
Nmap scan report for l1.ifwcreations.com (103.69.196.105)
Host is up (0.027s latency).
PORT     STATE    SERVICE
21/tcp   open     ftp
22/tcp   filtered ssh
23/tcp   filtered telnet
25/tcp   filtered smtp
80/tcp   open     http
110/tcp  open     pop3
139/tcp  filtered netbios-ssn
443/tcp  open     https
445/tcp  filtered microsoft-ds
3389/tcp filtered ms-wbt-server
Nmap done: 1 IP address (1 host up) scanned in 1.63 seconds

Scanning Options Description 10.129.2.28 Scans the specified target. --top-ports=10 Scans the specified top ports that have been defined as most frequent

┌──(kali㉿kali)-[~/Desktop]
└─$ sudo nmap 103.69.196.105 -p 21 --packet-trace -Pn -n --disable-arp-ping
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-01 12:19 +0530
SENT (0.0559s) TCP 192.168.115.128:59230 > 103.69.196.105:21 S ttl=57 id=46918 iplen=44  seq=1000177425 win=1024 <mss 1460>
RCVD (0.1302s) TCP 103.69.196.105:21 > 192.168.115.128:59230 SA ttl=128 id=42012 iplen=44  seq=95253106 win=64240 <mss 1460>
Nmap scan report for 103.69.196.105
Host is up (0.075s latency).
PORT   STATE SERVICE
21/tcp open  ftp
Nmap done: 1 IP address (1 host up) scanned in 0.18 seconds

Request (SENT)

Message Description SENT (0.0559s) Indicates that Nmap sent a packet to the target. TCP Shows the protocol being used to communicate with the target. 192.168.115.128:59230 > Represents our Kali machine's IP address and source port. 103.69.196.105:21 Represents the target IP address and destination port 21 (FTP). S SYN flag used to initiate a TCP connection. ttl=57 Time To Live value of the outgoing IP packet. id=46918 IP identification number assigned to the packet. iplen=44 Total IP packet length is 44 bytes. seq=1000177425 TCP sequence number used to track data in the connection. win=1024 TCP window size advertised by our machine. <mss 1460> Maximum Segment Size advertised by our machine.

Response (RCVD)

Message Description RCVD (0.1302s) Indicates that Nmap received a response packet from the target. TCP Shows the protocol being used for communication. 103.69.196.105:21 > Represents the target IP address and source port 21. 192.168.115.128:59230 Represents our Kali IP address and destination port. SA SYN and ACK flags, indicating that the target is responding positively to the connection request. ttl=128 Time To Live value of the received IP packet. id=42012 IP identification number assigned to the response packet. iplen=44 Total IP packet length is 44 bytes. seq=95253106 TCP sequence number generated by the target. win=64240 TCP window size advertised by the target. <mss 1460> Maximum Segment Size advertised by the target.

Final Result

Message Description 21/tcp TCP port 21, commonly associated with FTP. open The target is accepting TCP connection requests on this port. ftp Service commonly associated with port 21.

Conclusion: Our Kali machine sent a SYN packet (S), and the target responded with SYN/ACK (SA). This confirms that TCP port 21 is open on the target.

1116

We used -p 21 to scan only FTP port 21, --packet-trace to see the packets sent and received, -Pn to skip host discovery, -n to disable DNS resolution, and --disable-arp-ping to prevent ARP-based host discovery, allowing us to focus on how the TCP SYN scan works and how the target responds.

Scanning Options Description 10.129.2.28 Scans the specified target. -p 21 Scans only the specified port. --packet-trace Shows all packets sent and received. -n Disables DNS resolution. --disable-arp-ping Disables ARP ping. -Pn Treat all hosts as online -- skip host discovery

  • -sS: Sends SYN, receives SYN-ACK, then normally sends RST. It does not complete the three-way handshake. : A SYN scan reduces normal connection-level logging, but it does not guarantee that your scan will go unnoticed.
  • -sT: Completes SYN → SYN-ACK → ACK, establishing a TCP connection. which is more noisy as it complete full scan
$ sudo nmap 103.69.196.105  -p 443 --packet-trace --disable-arp-ping -Pn -n --reason -sT
[sudo] password for kali:
Sorry, try again.
[sudo] password for kali:
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-01 19:09 +0530
CONN (0.0346s) TCP localhost > 103.69.196.105:443 => Operation now in progress
CONN (0.1016s) TCP localhost > 103.69.196.105:443 => Connected
Nmap scan report for 103.69.196.105
Host is up, received user-set (0.067s latency).
PORT    STATE SERVICE REASON
443/tcp open  https   syn-ack
Nmap done: 1 IP address (1 host up) scanned in 0.10 seconds
CONN (0.0346s) TCP localhost > 103.69.196.105:443 => Operation now in progress
CONN (0.1016s) TCP localhost > 103.69.196.105:443 => Connected

Packet Trace Explanation

Output Description CONN Nmap is performing a TCP Connect operation. 0.0346s Time elapsed when the connection attempt started. TCP localhost Source is the local Kali machine. 103.69.196.105:443 Destination IP address and port. Operation now in progress TCP connection attempt has started but is not complete. 0.1016s Time elapsed when the connection completed. Connected TCP connection was successfully established.

Scan Result Explanation

Field Value Description Port 443/tcp TCP port 443 was scanned. State open Port is accepting TCP connections. Service https Common service associated with port 443. Reason syn-ack Target returned SYN-ACK, indicating the port is open.

Nmap Options

Option Description -p 443 Scan only port 443. --packet-trace Display packet-related debugging information. --disable-arp-ping Disable ARP ping discovery. -Pn Skip host discovery. -n Disable DNS resolution. --reason Show the reason for the port state. -sT Perform a TCP Connect scan.

Key Observation

-sT completes the TCP three-way handshake. The Connected message confirms that the connection was successfully established. However, it does not confirm that the HTTPS application itself is functioning correctly.

┌──(kali㉿kali)-[~/Desktop]
└─$ sudo nmap 103.69.196.105 -p 139 --packet-trace -n --disable-arp-ping -Pn
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-01 19:12 +0530
SENT (0.0755s) TCP 192.168.115.128:51561 > 103.69.196.105:139 S ttl=57 id=13913 iplen=44  seq=3046163250 win=1024 <mss 1460>
SENT (1.1194s) TCP 192.168.115.128:51563 > 103.69.196.105:139 S ttl=41 id=50231 iplen=44  seq=3046294320 win=1024 <mss 1460>
Nmap scan report for 103.69.196.105
Host is up.
PORT    STATE    SERVICE
139/tcp filtered netbios-ssn
Nmap done: 1 IP address (1 host up) scanned in 2.12 seconds

Output Description SENT Nmap sent a TCP packet to the target. 0.0755s Time elapsed when the first packet was sent. TCP Protocol used for communication. 192.168.115.128 Your Kali machine's IP address. 51561 Source port selected by Nmap. 103.69.196.105 Target IP address. 139 Destination port (NetBIOS Session Service). S TCP SYN flag; Nmap is requesting a connection. ttl=57 Time To Live value in the outgoing IP packet. id=13913 IP identification field. iplen=44 Total IP packet length. seq=3046163250 TCP sequence number. win=1024 TCP window size advertised by Nmap. <mss 1460> Maximum TCP segment size option.

2. Why are there two SENT packets?

Packet Source Port Destination Explanation First 51561 103.69.196.105:139 Initial SYN probe. Second 51563 103.69.196.105:139 Retransmission after no response.

Nmap sent another SYN because it did not receive a response to the first probe within the expected time.

3. Scan Result Explanation

Field Value Description Port 139/tcp NetBIOS Session Service port. State filtered Nmap cannot determine whether the port is open or closed because packets appear to be filtered. Service netbios-ssn Service commonly associated with NetBIOS Session Service.

4. What happened technically?

Pasted image 20261101191614.png

5. Why might port 139 be filtered?

  • Firewall may be dropping incoming TCP SYN packets.
  • Network ACL may be blocking port 139.
  • An IPS/security device may be silently dropping the traffic.
  • The target or an intermediate network device may not be responding.

Important: filtered does not mean closed. It means Nmap could not determine the port's actual state.

┌──(kali㉿kali)-[~/Desktop]
└─$ sudo nmap 103.69.196.105  -p 445 --packet-trace -n --disable-arp-ping -Pn
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-01 20:40 +0530
SENT (0.0774s) TCP 192.168.115.128:53979 > 103.69.196.105:445 S ttl=46 id=60804 iplen=44  seq=574405271 win=1024 <mss 1460>
SENT (1.0871s) TCP 192.168.115.128:53981 > 103.69.196.105:445 S ttl=38 id=3119 iplen=44  seq=574536341 win=1024 <mss 1460>
Nmap scan report for 103.69.196.105
Host is up.
PORT    STATE    SERVICE
445/tcp filtered microsoft-ds
Nmap done: 1 IP address (1 host up) scanned in 2.12 seconds

Discovering Open UDP Ports

Imagine you are scanning a server that has TCP port 443 (HTTPS) and UDP port 53 (DNS) open.

None 
┌──(kali㉿kali)-[~/Desktop]
└─$ sudo nmap 103.69.196.105 -F  -sU
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-01 20:49 +0530
Nmap scan report for l1.ifwcreations.com (103.69.196.105)
Host is up (0.018s latency).
Not shown: 999 open|filtered udp ports (no-response)
PORT   STATE SERVICE
53/udp open  domain
Nmap done: 1 IP address (1 host up) scanned in 10.68 seconds
┌──(kali㉿kali)-[~/Desktop]
└─$ sudo nmap -sU -sV -p 53 103.69.196.105
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-01 20:51 +0530
Nmap scan report for l1.ifwcreations.com (103.69.196.105)
Host is up (0.010s latency).
PORT   STATE SERVICE VERSION
53/udp open  domain  PowerDNS Authoritative Server 4.9.5
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 0.70 seconds

PowerDNS Authoritative Server is DNS server software responsible for providing authoritative DNS answers for configured domains.

Scanning Options Description 103.69.196.105 Scans the specified target. -F Scans top 100 ports. -sU Performs a UDP scan

┌──(kali㉿kali)-[~/Desktop]
└─$ sudo nmap 103.69.196.105 -sU -Pn -n --disable-arp-ping --packet-trace -p 53 --reason
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-01 20:55 +0530
SENT (0.1432s) UDP 192.168.115.128:47482 > 103.69.196.105:53 ttl=44 id=24539 iplen=58
SENT (0.1433s) UDP 192.168.115.128:47482 > 103.69.196.105:53 ttl=53 id=24539 iplen=40
SENT (0.1434s) UDP 192.168.115.128:47482 > 103.69.196.105:53 ttl=56 id=24539 iplen=74
RCVD (0.2800s) UDP 103.69.196.105:53 > 192.168.115.128:47482 ttl=128 id=12183 iplen=74
Nmap scan report for 103.69.196.105
Host is up, received user-set (0.14s latency).
PORT   STATE SERVICE REASON
53/udp open  domain  udp-response ttl 128
Nmap done: 1 IP address (1 host up) scanned in 0.32 seconds

Output Description SENT Nmap sent a UDP packet. 0.1432s Time elapsed when the first packet was sent. UDP Protocol used for communication. 192.168.115.128:47482 Kali IP address and source port. 103.69.196.105:53 Target IP address and destination port. ttl=44 TTL value in the outgoing packet. id=24539 IP identification field. iplen=58 Total IP packet length in bytes. Second SENT Nmap sent another UDP probe with a different payload. Third SENT Nmap sent an additional UDP probe with another payload. RCVD Nmap received a response from the target. 103.69.196.105:53 Source of the UDP response (target DNS server). 192.168.115.128:47482 Destination of the response (Kali machine). ttl=128 TTL value in the received packet. id=12183 IP identification field in the response. iplen=74 Total received IP packet length in bytes.

Final Scan Result

Field Value Description Port 53/udp UDP port 53 was scanned. State open Target responded to the UDP probe. Service domain DNS service. Reason udp-response Nmap received a UDP response, confirming the port is open.

Command Options

Option Description -sU Perform UDP scanning. -Pn Skip host discovery. -n Disable DNS resolution. --disable-arp-ping Disable ARP ping discovery. --packet-trace Display sent and received packet details. -p 53 Scan only UDP port 53. --reason Display the reason for the port state.

┌──(kali㉿kali)-[~/Desktop]
└─$ sudo nmap 103.69.196.105  -Pn -n --disable-arp-ping --packet-trace -p465 --reason  -sV
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-01 21:05 +0530
SENT (0.1230s) TCP 192.168.115.128:47075 > 103.69.196.105:465 S ttl=52 id=33113 iplen=44  seq=2117022500 win=1024 <mss 1460>
RCVD (0.2317s) TCP 103.69.196.105:465 > 192.168.115.128:47075 SA ttl=128 id=31286 iplen=44  seq=1866104495 win=64240 <mss 1460>
NSOCK INFO [0.3480s] nsock_iod_new2(): nsock_iod_new (IOD #1)
NSOCK INFO [0.3480s] nsock_connect_tcp(): TCP connection requested to 103.69.196.105:465 (IOD #1) (timeout: 5000ms) EID 8
NSOCK INFO [0.4370s] nsock_trace_handler_callback(): Callback: CONNECT SUCCESS for EID 8 [103.69.196.105:465]
Service scan sending probe NULL to 103.69.196.105:465 (tcp)
NSOCK INFO [0.4370s] nsock_read(): Read request from IOD #1 [103.69.196.105:465] (timeout: 6000ms) EID 18
NSOCK INFO [6.4440s] nsock_trace_handler_callback(): Callback: READ TIMEOUT for EID 18 [103.69.196.105:465]
Service scan sending probe SSLSessionReq to 103.69.196.105:465 (tcp)
NSOCK INFO [6.4440s] nsock_write(): Write request for 88 bytes to IOD #1 EID 27 [103.69.196.105:465]
NSOCK INFO [6.4440s] nsock_read(): Read request from IOD #1 [103.69.196.105:465] (timeout: 5000ms) EID 34
NSOCK INFO [6.4450s] nsock_trace_handler_callback(): Callback: WRITE SUCCESS for EID 27 [103.69.196.105:465]
NSOCK INFO [6.6010s] nsock_trace_handler_callback(): Callback: READ SUCCESS for EID 34 [103.69.196.105:465] (7 bytes): ......(
Service scan hard match (Probe SSLSessionReq matched with SSLSessionReq line 13733): 103.69.196.105:465 is ssl.  Version: ||||
NSOCK INFO [6.6010s] nsock_iod_delete(): nsock_iod_delete (IOD #1)
NSOCK INFO [6.6010s] nsock_iod_new2(): nsock_iod_new (IOD #2)
NSOCK INFO [6.6010s] nsock_connect_ssl(): SSL connection requested to 103.69.196.105:465/tcp (IOD #2) (timeout: 8000ms) EID 41
NSOCK INFO [7.0100s] nsock_trace_handler_callback(): Callback: SSL-CONNECT SUCCESS for EID 41 [103.69.196.105:465]
Service scan sending probe NULL to 103.69.196.105:465 (tcp)
NSOCK INFO [7.0150s] nsock_read(): Read request from IOD #2 [103.69.196.105:465] (timeout: 6000ms) EID 50
NSOCK INFO [7.1200s] nsock_trace_handler_callback(): Callback: READ SUCCESS for EID 50 [103.69.196.105:465] (179 bytes)
Service scan hard match (Probe NULL matched with NULL line 3136): 103.69.196.105:465 is SSL/smtp.  Version: |Exim smtpd|4.99.1||
NSOCK INFO [7.1200s] nsock_iod_delete(): nsock_iod_delete (IOD #2)
Nmap scan report for 103.69.196.105
Host is up, received user-set (0.11s latency).
PORT    STATE SERVICE  REASON          VERSION
465/tcp open  ssl/smtp syn-ack ttl 128 Exim smtpd 4.99.1
Service Info: Host: l1.ifwcreations.com
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 7.14 seconds

Output Description SENT Nmap sent a TCP packet. 0.1230s Time elapsed when the packet was sent. TCP Protocol used for communication. 192.168.115.128 Source IP address (Kali machine). 47075 Source port selected by Nmap. 103.69.196.105 Destination IP address (target). 465 Destination port (SMTPS). S SYN flag requesting a TCP connection. ttl=52 TTL value in the outgoing packet. id=33113 IP identification field. iplen=44 Total IP packet length in bytes. seq=2117022500 TCP sequence number. win=1024 TCP window size. <mss 1460> Maximum TCP segment size option.

2. RCVD Packet Explanation

Output Description RCVD Nmap received a response. TCP Response received over TCP. 103.69.196.105:465 Response source (target IP and port). 192.168.115.128:47075 Response destination (Kali IP and source port). SA SYN-ACK flags; target accepted the TCP connection request. ttl=128 TTL value in the received packet. id=31286 IP identification field. iplen=44 Total IP packet length. seq=1866104495 TCP sequence number. win=64240 TCP window size advertised by the target. <mss 1460> Maximum TCP segment size option.

3. NSOCK Output Explanation

Output Description nsock_iod_new2() Nmap created a network communication object. nsock_connect_tcp() Nmap requested a TCP connection to port 465. CONNECT SUCCESS TCP connection was successfully established. Service scan sending probe NULL Nmap sent an initial service-detection probe. nsock_read() Nmap waited to receive data from the target. READ TIMEOUT No response arrived within the configured timeout. SSLSessionReq Nmap sent an SSL/TLS-related probe. WRITE SUCCESS Probe was successfully transmitted. READ SUCCESS Nmap successfully received a response. 7 bytes Size of the received response. hard match Nmap matched the response against its service-detection database. is ssl Nmap identified SSL/TLS. nsock_connect_ssl() Nmap requested an SSL/TLS connection. SSL-CONNECT SUCCESS SSL/TLS connection was successfully established. 179 bytes Size of the received service response. is SSL/smtp Nmap identified SMTP over SSL/TLS. Exim smtpd Identified mail server software. 4.99.1 Detected Exim version. nsock_iod_delete() Nmap closed its network communication object.

4. Final Scan Result

Field Value Description Port 465/tcp TCP port 465. State open Port accepts TCP connections. Service ssl/smtp SMTP over SSL/TLS. Reason syn-ack Target responded with SYN-ACK. TTL 128 TTL observed in the response. Software Exim smtpd Mail server software. Version 4.99.1 Detected Exim version. Host l1.ifwcreations.com Hostname associated with the target.

5. What Happened During the Scan?

Step Activity Result 1 Nmap sent TCP SYN. Connection requested. 2 Target returned SYN-ACK. Port 465 identified as open. 3 Nmap established a TCP connection for service detection. Connection successful. 4 Nmap sent a NULL probe. Read timeout. 5 Nmap sent an SSLSessionReq probe. Response received. 6 Nmap established an SSL/TLS connection. SSL connection successful. 7 Nmap received SMTP service information. Exim 4.99.1 identified.

6. Nmap Command Options

Option Description -Pn Skip host discovery. -n Disable DNS resolution. --disable-arp-ping Disable ARP ping discovery. --packet-trace Display sent and received packet details. -p 465 Scan only TCP port 465. --reason Display the reason for the port state. -sV Detect service and software version.

Pasted image 20261101212338.png

┌──(kali㉿kali)-[~/Desktop]
└─$ sudo nmap  10.129.29.43  -sV --script dns-brute
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-01 21:28 +0530
Stats: 0:01:24 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 85.71% done; ETC: 21:30 (0:00:13 remaining)
Nmap scan report for 10.129.29.43
Host is up (0.73s latency).
Not shown: 993 closed tcp ports (reset)
PORT      STATE SERVICE     VERSION
22/tcp    open  ssh         OpenSSH 7.6p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
80/tcp    open  http        Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
110/tcp   open  pop3        Dovecot pop3d
139/tcp   open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
143/tcp   open  imap        Dovecot imapd (Ubuntu)
445/tcp   open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
31337/tcp open  Elite?
| fingerprint-strings:
|   GetRequest:
|_    220 HTB{pr0F7pDv3r510nb4nn3r}
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port31337-TCP:V=7.99%I=7%D=11/1%Time=6AE761C3%P=x86_64-pc-linux-gnu%r(G
SF:etRequest,1F,"220\x20HTB{pr0F7pDv3r510nb4nn3r}\r\n");
Service Info: Host: NIX-NMAP-DEFAULT; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Saving the Results

Perform a full TCP port scan on your target and create an HTML report. Submit the number of the highest port as the answer.

Pasted image 20261101214006.png

──(kali㉿kali)-[~/Desktop/s]
└─$ xsltproc host.xml -o target.html
host.gnmap  host.nmap  host.xml  target.html

Pasted image 20261101213812.png

Service Enumeration

862

Imagine a mechanic diagnosing a car. Knowing that it's a petrol car isn't enough. He needs to know its exact model and engine version to identify known defects and find the correct replacement parts.

The same concept applies to cybersecurity. If Nmap identifies Exim SMTP 4.99.1, we can search for vulnerabilities affecting that specific version, examine its source code, and check whether the target's configuration meets the vulnerability requirements. In short: Identifying the application tells us what we're dealing with; identifying its exact version helps us find the right security weaknesses and assess the actual risk.

┌──(kali㉿kali)-[~/Desktop/s]
└─$ sudo nmap  10.129.29.43  -F
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-01 22:02 +0530
Nmap scan report for 10.129.29.43
Host is up (0.30s latency).
Not shown: 94 closed tcp ports (reset)
PORT    STATE SERVICE
22/tcp  open  ssh
80/tcp  open  http
110/tcp open  pop3
139/tcp open  netbios-ssn
143/tcp open  imap
445/tcp open  microsoft-ds
Nmap done: 1 IP address (1 host up) scanned in 2.72 seconds
┌──(kali㉿kali)-[~/Desktop/s]
└─$ sudo nmap  10.129.29.43 --stats-every=5s
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-01 22:03 +0530
Nmap scan report for 10.129.29.43
Host is up (0.50s latency).
Not shown: 993 closed tcp ports (reset)
PORT      STATE SERVICE
22/tcp    open  ssh
80/tcp    open  http
110/tcp   open  pop3
139/tcp   open  netbios-ssn
143/tcp   open  imap
445/tcp   open  microsoft-ds
31337/tcp open  Elite
Nmap done: 1 IP address (1 host up) scanned in 4.97 seconds

Scanning Options Description 10.129.2.28 Scans the specified target. -p- Scans all ports. -sV Performs service version detection on specified ports. --stats-every=5s Shows the progress of the scan every 5 seconds

We can also increase the verbosity level (-v / -vv), which will show us the open ports directly when Nmap detects them.

──(kali㉿kali)-[~/Desktop/s]
└─$ sudo nmap  10.129.29.43 -p- -sV -v
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-01 22:04 +0530
NSE: Loaded 48 scripts for scanning.
Initiating Ping Scan at 22:04
Scanning 10.129.29.43 [4 ports]
Completed Ping Scan at 22:04, 0.26s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 22:04
Completed Parallel DNS resolution of 1 host. at 22:04, 0.50s elapsed
Initiating SYN Stealth Scan at 22:04
Scanning 10.129.29.43 [65535 ports]
Discovered open port 139/tcp on 10.129.29.43
Discovered open port 445/tcp on 10.129.29.43
Discovered open port 22/tcp on 10.129.29.43
Discovered open port 80/tcp on 10.129.29.43
Discovered open port 143/tcp on 10.129.29.43
Discovered open port 110/tcp on 10.129.29.43

Scanning Options Description 10.129.2.28 Scans the specified target. -p- Scans all ports. -sV Performs service version detection on specified ports. -v Increases the verbosity of the scan, which displays more detailed information

─$ sudo nmap  10.129.29.43 -sV -v
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-01 22:06 +0530
NSE: Loaded 48 scripts for scanning.
Initiating Ping Scan at 22:06
Scanning 10.129.29.43 [4 ports]
Completed Ping Scan at 22:06, 0.24s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 22:06
Completed Parallel DNS resolution of 1 host. at 22:06, 0.50s elapsed
Initiating SYN Stealth Scan at 22:06
Scanning 10.129.29.43 [1000 ports]
Discovered open port 143/tcp on 10.129.29.43
Discovered open port 110/tcp on 10.129.29.43
Discovered open port 139/tcp on 10.129.29.43
Discovered open port 445/tcp on 10.129.29.43
Discovered open port 22/tcp on 10.129.29.43
Discovered open port 80/tcp on 10.129.29.43
Discovered open port 31337/tcp on 10.129.29.43
Completed SYN Stealth Scan at 22:06, 3.39s elapsed (1000 total ports)
Initiating Service scan at 22:06
Scanning 7 services on 10.129.29.43
Completed Service scan at 22:07, 60.60s elapsed (7 services on 1 host)
NSE: Script scanning 10.129.29.43.
Initiating NSE at 22:07
Completed NSE at 22:07, 2.03s elapsed
Initiating NSE at 22:07
Completed NSE at 22:07, 1.94s elapsed
Nmap scan report for 10.129.29.43
Host is up (0.52s latency).
Not shown: 993 closed tcp ports (reset)
PORT      STATE SERVICE     VERSION
22/tcp    open  ssh         OpenSSH 7.6p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
80/tcp    open  http        Apache httpd 2.4.29 ((Ubuntu))
110/tcp   open  pop3        Dovecot pop3d
139/tcp   open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
143/tcp   open  imap        Dovecot imapd (Ubuntu)
445/tcp   open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
31337/tcp open  ftp         ProFTPD
Service Info: Host: NIX-NMAP-DEFAULT; OS: Linux; CPE: cpe:/o:linux:linux_kernel
Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 68.94 seconds
           Raw packets sent: 1092 (48.024KB) | Rcvd: 1089 (43.576KB)

Scanning Options Description 10.129.2.28 Scans the specified target. -p- Scans all ports. -sV Performs service version detection on specified ports.

-[~/Desktop]
└─$ sudo nmap  10.129.29.43 -sV -Pn -n --disable-arp-ping --packet-trace
[sudo] password for kali:
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-01 22:16 +0530
SENT (0.1454s) TCP 10.10.17.199:41848 > 10.129.29.43:554 S ttl=49 id=12759 iplen=44  seq=1851275170 win=1024 <mss 1460>
SENT (0.1454s) TCP 10.10.17.199:41848 > 10.129.29.43:3389 S ttl=40 id=23313 iplen=44  seq=1851275170 win=1024 <mss 1460>
SENT (0.1455s) TCP 10.10.17.199:41848 > 10.129.29.43:53 S ttl=44 id=5203 iplen=44  seq=1851275170 win=1024 <mss 1460>
SENT (0.1455s) TCP 10.10.17.199:41848 > 10.129.29.43:8888 S ttl=45 id=4904 iplen=44  seq=1851275170 win=1024 <mss 1460>
SENT (0.1456s) TCP 10.10.17.199:41848 > 10.129.29.43:8080 S ttl=56 id=40503 iplen=44  seq=1851275170 win=1024 <mss 1460>
SENT (0.1456s) TCP 10.10.17.199:41848 > 10.129.29.43:135 S ttl=42 id=41354 iplen=44  seq=1851275170 win=1024 <mss 1460>
SENT (0.1456s) TCP 10.10.17.199:41848 > 10.129.29.43:199 S ttl=46 id=48593 iplen=44  seq=1851275170 win=1024 <mss 1460>
SENT (0.1457s) TCP 10.10.17.199:41848 > 10.129.29.43:22 S ttl=37 id=46197 iplen=44  seq=1851275170 win=1024 <mss 1460>
SENT (0.1457s) TCP 10.10.17.199:41848 > 10.129.29.43:1720 S ttl=46 id=26165 iplen=44  seq=1851275170 win=1024 <mss 1460>
SENT (0.1457s) TCP 10.10.17.199:41848 > 10.129.29.43:21 S ttl=41 id=11349 iplen=44  seq=1851275170 win=1024 <mss 1460>
RCVD (0.3981s) TCP 10.129.29.43:554 > 10.10.17.199:41848 RA ttl=63 id=0 iplen=40  seq=0 win=0
SENT (0.4013s) TCP 10.10.17.199:41848 > 10.129.29.43:80 S ttl=59 id=27105 iplen=44  seq=1851275170 win=1024 <mss 1460>
SENT (0.4014s) TCP 10.10.17.199:41848 > 10.129.29.43:23 S ttl=48 id=36552 iplen=44  seq=1851275170 win=1024 <mss 1460>
RCVD (0.7398s) TCP 10.129.29.43:21 > 10.10.17.199:41848 RA ttl=63 id=0 iplen=40  seq=0 win=0
SENT (0.7428s) TCP 10.10.17.199:41848 > 10.129.29.43:111 S ttl=51 id=60354 iplen=44  seq=1851275170 win=1024 <mss 1460>
SENT (0.7429s) TCP 10.10.17.199:41848 > 10.129.29.43:1025 S ttl=52 id=35543 iplen=44  seq=1851275170 win=1024 <mss 1460>
RCVD (1.0487s) TCP 10.129.29.43:199 > 10.10.17.199:41848 RA ttl=63 id=0 iplen=40  seq=0 win=0
RCVD (1.0488s) TCP 10.129.29.43:53 > 10.10.17.199:41848 RA ttl=63 id=0 iplen=40  seq=0 win=0
RCVD (1.0489s) TCP 10.129.29.43:8888 > 10.10.17.199:41848 RA ttl=63 id=0 iplen=40  seq=0 win=0
RCVD (1.0490s) TCP 10.129.29.43:22 > 10.10.17.199:41848 SA ttl=63 id=0 iplen=44  seq=2070321130 win=64240 <mss 1346>
RCVD (1.0491s) TCP 10.129.29.43:3389 > 10.10.17.199:41848 RA ttl=63 id=0 iplen=40  seq=0 win=0
RCVD (1.0492s) TCP 10.129.29.43:1720 > 10.10.17.199:41848 RA ttl=63 id=0 iplen=40  seq=0 win=0
RCVD (1.0493s) TCP 10.129.29.43:135 > 10.10.17.199:41848 RA ttl=63 id=0 iplen=40  seq=0 win=0
RCVD (1.0494s) TCP 10.129.29.43:8080 > 10.10.17.199:41848 RA ttl=63 id=0 iplen=40  seq=0 win=0
SENT (1.0531s) TCP 10.10.17.199:41848 > 10.129.29.43:110 S ttl=37 id=35739 iplen=44  seq=1851275170 win=1024 <mss 1460>
SENT (1.0532s) TCP 10.10.17.199:41848 > 10.129.29.43:587 S ttl=43 id=32525 iplen=44  seq=1851275170 win=1024 <mss 1460>
SENT (1.0532s) TCP 10.10.17.199:41848 > 10.129.29.43:1723 S ttl=59 id=46814 iplen=44  seq=1851275170 win=1024 <mss 1460>
SENT (1.0533s) TCP 10.10.17.199:41848 > 10.129.29.43:443 S ttl=52 id=22907 iplen=44  seq=1851275170 win=1024 <mss 1460>
SENT (1.0533s) TCP 10.10.17.199:41848 > 10.129.29.43:139 S ttl=59 id=62481 iplen=44  seq=1851275170 win=1024 <mss 1460>
SENT (1.0535s) TCP 10.10.17.199:41848 > 10.129.29.43:3306 S ttl=41 id=49661 iplen=44  seq=1851275170 win=1024 <mss 1460>
SENT (1.0536s) TCP 10.10.17.199:41848 > 10.129.29.43:995 S ttl=38 id=12749 iplen=44  seq=1851275170 win=1024 <mss 1460>
SENT (1.0536s) TCP 10.10.17.199:41848 > 10.129.29.43:143 S ttl=45 id=15663 iplen=44  seq=1851275170 win=1024 <mss 1460>
SENT (1.0537s) TCP 10.10.17.199:41848 > 10.129.29.43:445 S ttl=44 id=31088 iplen=44  seq=1851275170 win=1024 <mss 1460>
SENT (1.0539s) TCP 10.10.17.199:41848 > 10.129.29.43:113 S ttl=39 id=18268 iplen=44  seq=1851275170 win=1024 <mss 1460>
SENT (1.0539s) TCP 10.10.17.199:41848 > 10.129.29.43:993 S ttl=41 id=3864 iplen=44  seq=1851275170 win=1024 <mss 1460>
SENT (1.0540s) TCP 10.10.17.199:41848 > 10.129.29.43:25 S ttl=56 id=14032 iplen=44  seq=1851275170 win=1024 <mss 1460>
SENT (1.0544s) TCP 10.10.17.199:41848 > 10.129.29.43:256 S ttl=46 id=33884 iplen=44  seq=1851275170 win=1024 <mss 1460>
SENT (1.0545s) TCP 10.10.17.199:41848 > 10.129.29.43:5900 S ttl=45 id=21770 iplen=44  seq=1851275170 win=1024 <mss 1460>
SENT (1.0546s) TCP 10.10.17.199:41848 > 10.129.29.43:4444 S ttl=50 id=17105 iplen=44  seq=1851275170 win=1024 <mss 1460>
SENT (1.0546s) TCP 10.10.17.199:41848 > 10.129.29.43:10010 S ttl=48 id=29443 iplen=44  seq=1851275170 win=1024 <mss 1460>
RCVD (1.3557s) TCP 10.129.29.43:80 > 10.10.17.199:41848 SA ttl=63 id=0 iplen=44  seq=4263283247 win=64240 <mss 1346>

Scanning Options Description 10.129.2.28 Scans the specified target. -p- Scans all ports. -sV Performs service version detection on specified ports. -Pn Disables ICMP Echo requests. -n Disables DNS resolution. --disable-arp-ping Disables ARP ping. --packet-trace Shows all packets sent and received.

Common TTL Values and Their Meaning TTL (Time To Live) is an IP packet field that determines how many network hops a packet can pass through before being discarded. Every router decreases TTL by 1.

Different operating systems commonly use different initial TTL values.

Initial TTL Commonly associated with 32 Older Unix systems / embedded devices 60 Some Unix/Linux systems 64 Linux, Android, macOS, FreeBSD 128 Windows systems 255 Network devices, routers, switches, some Unix systems

┌──(kali㉿kali)-[~/Desktop]
└─$ ping 103.69.196.105
PING 103.69.196.105 (103.69.196.105) 56(84) bytes of data.
64 bytes from 103.69.196.105: icmp_seq=1 ttl=128 time=72.8 ms     so it windows server
64 bytes from 103.69.196.105: icmp_seq=2 ttl=128 time=81.1 ms
└─$ nmap -sS -sV 10.129.29.43
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-01 22:23 +0530
Stats: 0:01:38 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 85.71% done; ETC: 22:25 (0:00:16 remaining)
Nmap scan report for 10.129.29.43
Host is up (0.51s latency).
Not shown: 993 closed tcp ports (reset)
PORT      STATE SERVICE     VERSION
22/tcp    open  ssh         OpenSSH 7.6p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
80/tcp    open  http        Apache httpd 2.4.29 ((Ubuntu))
110/tcp   open  pop3        Dovecot pop3d
139/tcp   open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
143/tcp   open  imap        Dovecot imapd (Ubuntu)
445/tcp   open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
31337/tcp open  Elite?
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port31337-TCP:V=7.99%I=7%D=11/1%Time=6AE76EB4%P=x86_64-pc-linux-gnu%r(G
SF:etRequest,1F,"220\x20HTB{pr0F7pDv3r510nb4nn3r}\r\n");
Service Info: Host: NIX-NMAP-DEFAULT; OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 180.35 seconds

Pasted image 20261101222952.png

Think of it like a security guard asking every department in a building to identify itself. One department might reveal more information than expected. Here, we used -sV to make Nmap send service-detection probes to open ports. Port 31337 returned an unusual banner containing the flag

Nmap Scripting Engine

Nmap Scripting Engine (NSE) is a feature of Nmap that allows us to perform automated security checks using scripts written in Lua.

Think of it like a security inspector in a building. Nmap identifies the doors (open ports), while NSE scripts inspect what is behind those doors — for example, checking service information, configurations and known security weaknesses.

┌──(kali㉿kali)-[~/Desktop]
└─$ nmap -sC 10.129.29.43
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-01 22:30 +0530
Nmap scan report for 10.129.29.43
Host is up (0.48s latency).
Not shown: 993 closed tcp ports (reset)
PORT      STATE SERVICE
22/tcp    open  ssh
| ssh-hostkey:
|   2048 71:c1:89:90:7f:fd:4f:60:e0:54:f3:85:e6:35:6c:2b (RSA)
|   256 e1:8e:53:18:42:af:2a:de:c0:12:1e:2e:54:06:4f:70 (ECDSA)
|_  256 1a:cc:ac:d4:94:5c:d6:1d:71:e7:39:de:14:27:3c:3c (ED25519)
80/tcp    open  http
|_http-title: Apache2 Ubuntu Default Page: It works
110/tcp   open  pop3
|_pop3-capabilities: CAPA AUTH-RESP-CODE SASL TOP RESP-CODES PIPELINING UIDL
139/tcp   open  netbios-ssn
143/tcp   open  imap
|_imap-capabilities: Pre-login LOGINDISABLEDA0001 more IDLE ENABLE capabilities LOGIN-REFERRALS IMAP4rev1 post-login listed OK have ID SASL-IR LITERAL+
445/tcp   open  microsoft-ds
31337/tcp open  Elite
Host script results:
| smb2-time:
|   date: 2026-10-31T16:58:14
|_  start_date: N/A
|_nbstat: NetBIOS name: NIX-NMAP-DEFAUL, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
|_clock-skew: mean: -1d00h22m47s, deviation: 34m37s, median: -1d00h02m48s
| smb-security-mode:
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb-os-discovery:
|   OS: Windows 6.1 (Samba 4.7.6-Ubuntu)
|   Computer name: nix-nmap-default
|   NetBIOS computer name: NIX-NMAP-DEFAULT\x00
|   Domain name: \x00
|   FQDN: nix-nmap-default
|_  System time: 2026-10-31T17:58:14+01:00
| smb2-security-mode:
|   3.1.1:
|_    Message signing enabled but not required
Nmap done: 1 IP address (1 host up) scanned in 80.51 seconds

Nmap Scripting Engine (NSE) Categories

Category Description auth Checks authentication mechanisms and identifies authentication-related weaknesses. broadcast Uses broadcast requests to discover hosts and services on a local network. brute Attempts to guess usernames and passwords using brute-force techniques. default Runs scripts selected by default for usefulness and safety. Executed using -sC. discovery Collects information about hosts, services, users, and network resources. dos Checks for Denial-of-Service vulnerabilities. Some scripts may disrupt services. exploit Attempts to exploit known vulnerabilities in target services. external Uses external services or resources to gather additional information. fuzzer Sends unexpected or malformed inputs to identify vulnerabilities and unusual application behaviour. intrusive Contains scripts that may negatively affect the target or generate significant traffic. malware Checks for signs of malware or malware-related activity. safe Contains scripts designed to avoid disruption or destructive activity. version Provides additional service-detection probes to identify application details and versions. vuln Checks services for specific known vulnerabilities and reports potential findings.

Useful commands

Command Purpose nmap -sC TARGET Runs default NSE scripts. nmap --script default TARGET Runs default scripts. nmap --script discovery TARGET Runs discovery scripts. nmap --script safe TARGET Runs safe-category scripts. nmap --script vuln TARGET Runs vulnerability-checking scripts. nmap --script auth TARGET Runs authentication-related scripts. nmap --script "safe,vuln" TARGET Runs scripts belonging to either category. nmap --script-help vuln Displays information about vulnerability scripts.

A script can belong to multiple categories. Categories such as dos, exploit, brute, and intrusive require particular caution and should only be used within authorized testing scopes.

example of — script safe

┌──(kali㉿kali)-[~/Desktop]
└─$ nmap --script safe 10.129.29.43
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-01 22:36 +0530
No profinet devices in the subnet
Pre-scan script results:
| broadcast-listener:
|   ether
|       ARP Request
|         sender ip      sender mac         target ip
|         192.168.115.1  00:50:56:c0:00:08  192.168.115.2
|   udp
|       DHCP
|         srv ip           cli ip           mask           gw             dns            vendor
|_        192.168.115.254  192.168.115.129  255.255.255.0  192.168.115.2  192.168.115.2  -
|_http-robtex-shared-ns: *TEMPORARILY DISABLED* due to changes in Robtex's API. See https://www.robtex.com/api/
| broadcast-ping:
|   IP: 192.168.115.2  MAC: 00:50:56:f7:d0:ca
|_  Use --script-args=newtargets to add the results as targets
| broadcast-dhcp-discover:
|   Response 1 of 1:
|     Interface: eth0
|     IP Offered: 192.168.115.129
|     Server Identifier: 192.168.115.254
|     Subnet Mask: 255.255.255.0
|     Router: 192.168.115.2
|     Domain Name Server: 192.168.115.2
|     Domain Name: localdomain
|     Broadcast Address: 192.168.115.255
|_    NetBIOS Name Server: 192.168.115.2
Bug in broadcast-upnp-info: no string output.
| targets-sniffer: Sniffed 15 address(es).
| 224.0.0.1
| 239.255.255.253
| 192.168.115.254
| 224.0.0.251
| 239.255.255.250
| 224.0.0.9
| fe80::bcf0:2e1f:5b47:f92b
| 0.0.0.0
| fe80::ced4:d982:b024:6818
| 192.168.115.2
| 224.0.0.13
| 192.168.115.1
| 224.0.0.252
| 224.0.23.12
|_154.57.19.131
| targets-ipv6-multicast-mld:
|   IP: fe80::ced4:d982:b024:6818  MAC: 00:50:56:c0:00:08  IFACE: eth0
|
|_  Use --script-args=newtargets to add the results as targets
| broadcast-igmp-discovery:
|   192.168.115.1
|     Interface: eth0
|     Version: 2
|     Group: 224.0.0.251
|     Description: mDNS (rfc6762)
|   192.168.115.1
|     Interface: eth0
|     Version: 2
|     Group: 224.0.0.252
|     Description: Link-local Multicast Name Resolution (rfc4795)
|   192.168.115.1
|     Interface: eth0
|     Version: 2
|     Group: 239.255.255.250
|     Description: Organization-Local Scope (rfc2365)
|_  Use the newtargets script-arg to add the results as targets
| eap-info:
| Available authentication methods with identity="anonymous" on interface eth0
|   unknown  EAP-TTLS
|   unknown  EAP-TLS
|   unknown  EAP-MSCHAP-V2
|_  unknown  PEAP
|_hostmap-robtex: *TEMPORARILY DISABLED* due to changes in Robtex's API. See https://www.robtex.com/api/
| targets-asn:
|_  targets-asn.asn is a mandatory parameter
Stats: 0:04:25 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 99.89% done; ETC: 22:40 (0:00:00 remaining)
Nmap scan report for 10.129.29.43
Host is up (0.47s latency).
Not shown: 993 closed tcp ports (reset)
Bug in http-security-headers: no string output.
PORT      STATE SERVICE
22/tcp    open  ssh
| ssh2-enum-algos:
|   kex_algorithms: (10)
|   server_host_key_algorithms: (5)
|   encryption_algorithms: (6)
|   mac_algorithms: (10)
|_  compression_algorithms: (2)
| ssh-hostkey:
|   2048 71:c1:89:90:7f:fd:4f:60:e0:54:f3:85:e6:35:6c:2b (RSA)
|   256 e1:8e:53:18:42:af:2a:de:c0:12:1e:2e:54:06:4f:70 (ECDSA)
|_  256 1a:cc:ac:d4:94:5c:d6:1d:71:e7:39:de:14:27:3c:3c (ED25519)
|_banner: SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.7
80/tcp    open  http
| http-comments-displayer:
| Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=10.129.29.43
|
|     Path: http://10.129.29.43:80/
|     Line number: 201
|     Comment:
|         <!--      <div class="table_of_contents floating_element">
|                 <div class="section_header section_header_grey">
|                   TABLE OF CONTENTS
|                 </div>
|                 <div class="table_of_contents_item floating_element">
|                   <a href="#about">About</a>
|                 </div>
|                 <div class="table_of_contents_item floating_element">
|                   <a href="#changes">Changes</a>
|                 </div>
|                 <div class="table_of_contents_item floating_element">
|                   <a href="#scope">Scope</a>
|                 </div>
|                 <div class="table_of_contents_item floating_element">
|                   <a href="#files">Config files</a>
|                 </div>
|               </div>
|         -->
|
|     Path: http://10.129.29.43:80/
|     Line number: 4
|     Comment:
|         <!--
|             Modified from the Debian original for Ubuntu
|             Last updated: 2014-03-19
|             See: https://launchpad.net/bugs/1288690
|_          -->
| http-useragent-tester:
|   Status for browser useragent: 200
|   Allowed User Agents:
|     Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
|     libwww
|     lwp-trivial
|     libcurl-agent/1.0
|     PHP/
|     Python-urllib/2.5
|     GT::WWW
|     Snoopy
|     MFC_Tear_Sample
|     HTTP::Lite
|     PHPCrawl
|     URI::Fetch
|     Zend_Http_Client
|     http client
|     PECL::HTTP
|     Wget/1.13.4 (linux-gnu)
|_    WWW-Mechanize/1.34
|_http-xssed: ERROR: Script execution failed (use -d to debug)
|_http-referer-checker: Couldn't find any cross-domain scripts.
|_http-mobileversion-checker: No mobile version detected.
|_http-title: Apache2 Ubuntu Default Page: It works
|_http-date: Sat, 31 Oct 2026 17:05:05 GMT; -1d00h02m47s from local time.
| http-headers:
|   Date: Sat, 31 Oct 2026 17:05:04 GMT
|   Server: Apache/2.4.29 (Ubuntu)
|   Last-Modified: Thu, 10 Sep 2020 02:14:12 GMT
|   ETag: "2c39-5aeec1fc9d59d"
|   Accept-Ranges: bytes
|   Content-Length: 11321
|   Vary: Accept-Encoding
|   Connection: close
|   Content-Type: text/html
|
|_  (Request type: HEAD)
| http-grep:
|   (1) http://10.129.29.43:80/manual:
|     (1) ip:
|_      + 10.129.29.43
|_http-fetch: Please enter the complete path of the directory to save data in.
110/tcp   open  pop3
|_pop3-capabilities: UIDL CAPA RESP-CODES AUTH-RESP-CODE PIPELINING TOP SASL
|_banner: +OK Dovecot (Ubuntu) ready.
139/tcp   open  netbios-ssn
143/tcp   open  imap
|_imap-capabilities: LITERAL+ more have post-login capabilities Pre-login IMAP4rev1 listed IDLE LOGIN-REFERRALS SASL-IR ENABLE LOGINDISABLEDA0001 OK ID
|_banner: * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ...
445/tcp   open  microsoft-ds
31337/tcp open  Elite
|_banner: 220 HTB{pr0F7pDv3r510nb4nn3r}
Host script results:
| qscan:
| PORT   FAMILY  MEAN (us)  STDDEV     LOSS (%)
| 1      0       809859.50  134772.91  0.0%
| 22     0       796681.00  161928.41  0.0%
| 80     0       764602.50  141561.14  0.0%
| 110    0       721583.90  204922.29  0.0%
| 139    0       756067.10  196143.64  0.0%
| 143    0       738644.30  140992.45  0.0%
| 445    0       801527.20  174973.04  0.0%
|_31337  0       818289.10  154175.21  0.0%
|_path-mtu: PMTU == 1500
| smb2-capabilities:
|   2.0.2:
|     Distributed File System
|   2.1:
|     Distributed File System
|     Leasing
|     Multi-credit operations
|   3.0:
|     Distributed File System
|     Leasing
|     Multi-credit operations
|   3.0.2:
|     Distributed File System
|     Leasing
|     Multi-credit operations
|   3.1.1:
|     Distributed File System
|     Leasing
|_    Multi-credit operations
|_msrpc-enum: NT_STATUS_OBJECT_NAME_NOT_FOUND
| unusual-port:
|_  WARNING: this script depends on Nmap's service/version detection (-sV)
|_ipidseq: All zeros
|_nbstat: NetBIOS name: NIX-NMAP-DEFAUL, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
|_clock-skew: mean: -1d00h17m46s, deviation: 29m58s, median: -1d00h02m48s
| smb-protocols:
|   dialects:
|     NT LM 0.12 (SMBv1) [dangerous, but default]
|     2.0.2
|     2.1
|     3.0
|     3.0.2
|_    3.1.1
| dns-blacklist:
|   SPAM
|_    list.quorum.to - SPAM
| smb-security-mode:
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
|_smb-mbenum: ERROR: Script execution failed (use -d to debug)
| smb2-time:
|   date: 2026-10-31T17:04:02
|_  start_date: N/A
| smb2-security-mode:
|   3.1.1:
|_    Message signing enabled but not required
| port-states:
|   tcp:
|     open: 22,80,110,139,143,445,31337
|_    closed: 1,3-4,6-7,9,13,17,19-21,23-26,30,32-33,37,42-43,49,53,70,79,81-85,88-90,99-100,106,109,111,113,119,125,135,144,146,161,163,179,199,211-212,222,254-256,259,264,280,301,306,311,340,366,389,406-407,416-417,425,427,443-444,458,464-465,481,497,500,512-515,524,541,543-545,548,554-555,563,587,593,616-617,625,631,636,646,648,666-668,683,687,691,700,705,711,714,720,722,726,749,765,777,783,787,800-801,808,843,873,880,888,898,900-903,911-912,981,987,990,992-993,995,999-1002,1007,1009-1011,1021-1100,1102,1104-1108,1110-1114,1117,1119,1121-1124,1126,1130-1132,1137-1138,1141,1145,1147-1149,1151-1152,1154,1163-1166,1169,1174-1175,1183,1185-1187,1192,1198-1199,1201,1213,1216-1218,1233-1234,1236,1244,1247-1248,1259,1271-1272,1277,1287,1296,1300-1301,1309-1311,1322,1328,1334,1352,1417,1433-1434,1443,1455,1461,1494,1500-1501,1503,1521,1524,1533,1556,1580,1583,1594,1600,1641,1658,1666,1687-1688,1700,1717-1721,1723,1755,1761,1782-1783,1801,1805,1812,1839-1840,1862-1864,1875,1900,1914,1935,1947,1971-1972,1974,1984,1998-2010,2013,2020-2022,2030,2033-2035,2038,2040-2043,2045-2049,2065,2068,2099-2100,2103,2105-2107,2111,2119,2121,2126,2135,2144,2160-2161,2170,2179,2190-2191,2196,2200,2222,2251,2260,2288,2301,2323,2366,2381-2383,2393-2394,2399,2401,2492,2500,2522,2525,2557,2601-2602,2604-2605,2607-2608,2638,2701-2702,2710,2717-2718,2725,2800,2809,2811,2869,2875,2909-2910,2920,2967-2968,2998,3000-3001,3003,3005-3006,3011,3017,3030-3031,3052,3071,3077,3128,3168,3211,3221,3260-3261,3268-3269,3283,3300-3301,3306,3322-3325,3333,3351,3367,3369-3372,3389-3390,3404,3476,3493,3517,3527,3546,3551,3580,3659,3689-3690,3703,3737,3766,3784,3800-3801,3809,3814,3826-3828,3851,3869,3871,3878,3880,3889,3905,3914,3918,3920,3945,3971,3986,3995,3998,4000-4006,4045,4111,4125-4126,4129,4224,4242,4279,4321,4343,4443-4446,4449,4550,4567,4662,4848,4899-4900,4998,5000-5004,5009,5030,5033,5050-5051,5054,5060-5061,5080,5087,5100-5102,5120,5190,5200,5214,5221-5222,5225-5226,5269,5280,5298,5357,5405,5414,5431-5432,5440,5500,5510,5544,5550,5555,5560,5566,5631,5633,5666,5678-5679,5718,5730,5800-5802,5810-5811,5815,5822,5825,5850,5859,5862,5877,5900-5904,5906-5907,5910-5911,5915,5922,5925,5950,5952,5959-5963,5985-5989,5998-6007,6009,6025,6059,6100-6101,6106,6112,6123,6129,6156,6346,6389,6502,6510,6543,6547,6565-6567,6580,6646,6666-6669,6689,6692,6699,6779,6788-6789,6792,6839,6881,6901,6969,7000-7002,7004,7007,7019,7025,7070,7100,7103,7106,7200-7201,7402,7435,7443,7496,7512,7625,7627,7676,7741,7777-7778,7800,7911,7920-7921,7937-7938,7999-8002,8007-8011,8021-8022,8031,8042,8045,8080-8090,8093,8099-8100,8180-8181,8192-8194,8200,8222,8254,8290-8292,8300,8333,8383,8400,8402,8443,8500,8600,8649,8651-8652,8654,8701,8800,8873,8888,8899,8994,9000-9003,9009-9011,9040,9050,9071,9080-9081,9090-9091,9099-9103,9110-9111,9200,9207,9220,9290,9415,9418,9485,9500,9502-9503,9535,9575,9593-9595,9618,9666,9876-9878,9898,9900,9917,9929,9943-9944,9968,9998-10004,10009-10010,10012,10024-10025,10082,10180,10215,10243,10566,10616-10617,10621,10626,10628-10629,10778,11110-11111,11967,12000,12174,12265,12345,13456,13722,13782-13783,14000,14238,14441-14442,15000,15002-15004,15660,15742,16000-16001,16012,16016,16018,16080,16113,16992-16993,17877,17988,18040,18101,18988,19101,19283,19315,19350,19780,19801,19842,20000,20005,20031,20221-20222,20828,21571,22939,23502,24444,24800,25734-25735,26214,27000,27352-27353,27355-27356,27715,28201,30000,30718,30951,31038,32768-32785,33354,33899,34571-34573,35500,38292,40193,40911,41511,42510,44176,44442-44443,44501,45100,48080,49152-49161,49163,49165,49167,49175-49176,49400,49999-50003,50006,50300,50389,50500,50636,50800,51103,51493,52673,52822,52848,52869,54045,54328,55055-55056,55555,55600,56737-56738,57294,57797,58080,60020,60443,61532,61900,62078,63331,64623,64680,65000,65129,65389
|_fcrdns: FAIL (No PTR record)
| smb-os-discovery:
|   OS: Windows 6.1 (Samba 4.7.6-Ubuntu)
|   Computer name: nix-nmap-default
|   NetBIOS computer name: NIX-NMAP-DEFAULT\x00
|   Domain name: \x00
|   FQDN: nix-nmap-default
|_  System time: 2026-10-31T18:04:04+01:00
Post-scan script results:
| reverse-index:
|   22/tcp: 10.129.29.43
|   80/tcp: 10.129.29.43
|   110/tcp: 10.129.29.43
|   139/tcp: 10.129.29.43
|   143/tcp: 10.129.29.43
|   445/tcp: 10.129.29.43
|_  31337/tcp: 10.129.29.43
Nmap done: 1 IP address (1 host up) scanned in 360.82 seconds

Script Finding Explanation broadcast-listener ARP and DHCP information Captures broadcast traffic from the local network. broadcast-ping 192.168.115.2 Discovers hosts responding to broadcast ping. broadcast-dhcp-discover DHCP: 192.168.115.254 Identifies the DHCP server and network configuration. targets-sniffer 15 IP addresses Captures IP addresses observed on the network. ssh2-enum-algos SSH algorithms Enumerates supported key exchange, encryption and MAC algorithms. ssh-hostkey RSA, ECDSA, ED25519 Retrieves SSH server public host keys. http-comments-displayer HTML comments Extracts comments embedded in website source code. http-headers Apache/2.4.29 Retrieves HTTP response headers and server information. http-title Apache2 Ubuntu Default Page Identifies the webpage title. pop3-capabilities POP3 features Identifies supported POP3 capabilities. imap-capabilities IMAP capabilities Identifies supported IMAP features. smb-protocols SMBv1, SMBv2, SMBv3 Identifies supported SMB protocol versions. smb-security-mode Signing disabled Identifies an SMB message-signing security concern. smb-os-discovery Samba 4.7.6-Ubuntu Retrieves OS-related information and hostname. smb2-capabilities DFS, Leasing, Multi-credit Identifies supported SMB2/SMB3 capabilities.

Other notable results

Output Meaning Bug in broadcast-upnp-info Script encountered an output error. http-xssed: ERROR Script execution failed; XSS is not confirmed. http-fetch: Please enter... Required directory argument is missing. targets-asn: mandatory parameter Required ASN parameter is missing. http-robtex-shared-ns: TEMPORARILY DISABLED External Robtex API functionality is unavailable.

┌──(kali㉿kali)-[~/Desktop]
└─$ sudo nmap -p445 --script smb-protocols 10.129.29.43
[sudo] password for kali:
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-01 22:47 +0530
Nmap scan report for 10.129.29.43
Host is up (0.28s latency).
PORT    STATE SERVICE
445/tcp open  microsoft-ds
Host script results:
| smb-protocols:
|   dialects:
|     NT LM 0.12 (SMBv1) [dangerous, but default]
|     2.0.2
|     2.1
|     3.0
|     3.0.2
|_    3.1.1
Nmap done: 1 IP address (1 host up) scanned in 11.15 seconds

Scanning Options Description 10.129.2.28 Scans the specified target. -p 445 Scans only the specified port. --script banner,smb-protocols Uses specified NSE scripts.

Method to find supported services in NSE scripts

grep -il "Service-Name" /usr/share/nmap/scripts/*.nse
$ sudo nmap -p80 --script vuln -sC -sV  10.129.29.43 --open-relay=5s
/usr/lib/nmap/nmap: unrecognized option '--open-relay=5s'
See the output of nmap -h for a summary of options
┌──(kali㉿kali)-[~/Desktop]
└─$ sudo nmap -p80 --script vuln -sC -sV  10.129.29.43 --stats-every=5s
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-01 22:54 +0530
NSE Timing: About 90.91% done; ETC: 22:56 (0:00:00 remaining)
Nmap scan report for 10.129.29.43
Host is up (0.29s latency).
PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
| http-enum:
|_  /robots.txt: Robots file
|_http-dombased-xss: Couldn't find any DOM based XSS.
|_http-csrf: Couldn't find any CSRF vulnerabilities.
| vulners:
|   cpe:/a:apache:http_server:2.4.29:
|       PACKETSTORM:176334      9.8     https://vulners.com/packetstorm/PACKETSTORM:176334      *EXPLOIT*
|       PACKETSTORM:171631      9.8     https://vulners.com/packetstorm/PACKETSTORM:171631      *EXPLOIT*
|       MEND:CVE-2026-59797     9.8     https://vulners.com/mend/MEND:CVE-2026-59797
|       MEND:CVE-2026-56154     9.8     https://vulners.com/mend/MEND:CVE-2026-56154
|       MEND:CVE-2026-44631     9.8     https://vulners.com/mend/MEND:CVE-2026-44631
|       MEND:CVE-2026-29167     9.8     https://vulners.com/mend/MEND:CVE-2026-29167
|       HTTPD:E8492EE5729E8FB514D3C0EE370C9BC6  9.8     https://vulners.com/httpd/HTTPD:E8492EE5729E8FB514D3C0EE370C9BC6
|       HTTPD:C072933AA965A86DA3E2C9172FFC1569  9.8     https://vulners.com/httpd/HTTPD:C072933AA965A86DA3E2C9172FFC1569
|       HTTPD:A1BBCE110E077FFBF4469D4F06DB9293  9.8     https://vulners.com/httpd/HTTPD:A1BBCE110E077FFBF4469D4F06DB9293
|       HTTPD:A09F9CEBE0B7C39EDA0480FEAEF4FE9D  9.8     https://vulners.com/httpd/HTTPD:A09F9CEBE0B7C39EDA0480FEAEF4FE9D
|       HTTPD:9BCBE3C14201AFC4B0F36F15CB40C0F8  9.8     https://vulners.com/httpd/HTTPD:9BCBE3C14201AFC4B0F36F15CB40C0F8
|       HTTPD:9AD76A782F4E66676719E36B64777A7A  9.8     https://vulners.com/httpd/HTTPD:9AD76A782F4E66676719E36B64777A7A
|       HTTPD:2BE0032A6ABE7CC52906DBAAFE0E448E  9.8     https://vulners.com/httpd/HTTPD:2BE0032A6ABE7CC52906DBAAFE0E448E
|       EDB-ID:51193    9.8     https://vulners.com/exploitdb/EDB-ID:51193      *EXPLOIT*
|       EAA88933-B773-535C-8E65-20383D59A2FE    9.8     https://vulners.com/githubexploit/EAA88933-B773-535C-8E65-20383D59A2FE  *EXPLOIT*
|       D5084D51-C8DF-5CBA-BC26-ACF2E33F8E52    9.8     https://vulners.com/githubexploit/D5084D51-C8DF-5CBA-BC26-ACF2E33F8E52  *EXPLOIT*
|       CVE-2026-59797  9.8     https://vulners.com/cve/CVE-2026-59797
|       CVE-2026-57941  9.8     https://vulners.com/cve/CVE-2026-57941
|       CVE-2026-56154  9.8     https://vulners.com/cve/CVE-2026-56154
|       CVE-2026-44631  9.8     https://vulners.com/cve/CVE-2026-44631
|       CVE-2026-29167  9.8     https://vulners.com/cve/CVE-2026-29167
|       CVE-2026-28780  9.8     https://vulners.com/cve/CVE-2026-28780
|       CVE-2024-38476  9.8     https://vulners.com/cve/CVE-2024-38476
|       CVE-2024-38474  9.8     https://vulners.com/cve/CVE-2024-38474
|       CVE-2023-25690  9.8     https://vulners.com/cve/CVE-2023-25690
|       CVE-2022-31813  9.8     https://vulners.com/cve/CVE-2022-31813
|       CVE-2022-23943  9.8     https://vulners.com/cve/CVE-2022-23943
|       CVE-2022-22720  9.8     https://vulners.com/cve/CVE-2022-22720
|       CVE-2021-44790  9.8     https://vulners.com/cve/CVE-2021-44790
|       CVE-2021-39275  9.8     https://vulners.com/cve/CVE-2021-39275
|       CVE-2021-26691  9.8     https://vulners.com/cve/CVE-2021-26691
|       CVE-2018-1312   9.8     https://vulners.com/cve/CVE-2018-1312
|       CNVD-2024-36391 9.8     https://vulners.com/cnvd/CNVD-2024-36391
|       CNVD-2024-36388 9.8     https://vulners.com/cnvd/CNVD-2024-36388
|       CNVD-2022-51061 9.8     https://vulners.com/cnvd/CNVD-2022-51061
|       CNVD-2022-41640 9.8     https://vulners.com/cnvd/CNVD-2022-41640
|       CNVD-2022-03225 9.8     https://vulners.com/cnvd/CNVD-2022-03225
|       CNVD-2021-102386        9.8     https://vulners.com/cnvd/CNVD-2021-102386
|       A8E17CED-DB4F-5C45-A53C-B855BE32362A    9.8     https://vulners.com/githubexploit/A8E17CED-DB4F-5C45-A53C-B855BE32362A  *EXPLOIT*
|       64A540A8-D918-5BEA-8F60-987F97B27A0C    9.8     https://vulners.com/githubexploit/64A540A8-D918-5BEA-8F60-987F97B27A0C  *EXPLOIT*
|       5C1BB960-90C1-5EBF-9BEF-F58BFFDFEED9    9.8     https://vulners.com/githubexploit/5C1BB960-90C1-5EBF-9BEF-F58BFFDFEED9  *EXPLOIT*
|       4DFF7163-45F2-5F1B-8C53-0A2457A04735    9.8     https://vulners.com/githubexploit/4DFF7163-45F2-5F1B-8C53-0A2457A04735  *EXPLOIT*
|       3F17CA20-788F-5C45-88B3-E12DB2979B7B    9.8     https://vulners.com/githubexploit/3F17CA20-788F-5C45-88B3-E12DB2979B7B  *EXPLOIT*
|       1337DAY-ID-39214        9.8     https://vulners.com/zdt/1337DAY-ID-39214        *EXPLOIT*
|       1337DAY-ID-38427        9.8     https://vulners.com/zdt/1337DAY-ID-38427        *EXPLOIT*
|       MEND:CVE-2026-73636     9.2     https://vulners.com/mend/MEND:CVE-2026-73636
|       MEND:CVE-2026-42535     9.1     https://vulners.com/mend/MEND:CVE-2026-42535
|       MEND:CVE-2025-49812     9.1     https://vulners.com/mend/MEND:CVE-2025-49812
|       KS:SCANNER-HTTP-CVE_2024_38475_DETECT   9.1     https://vulners.com/kittysploit/KS:SCANNER-HTTP-CVE_2024_38475_DETECT   *EXPLOIT*
|       HTTPD:509B04B8CC51879DD0A561AC4FDBE0A6  9.1     https://vulners.com/httpd/HTTPD:509B04B8CC51879DD0A561AC4FDBE0A6
|       HTTPD:3512E3F62E72F03B59F5E9CF8ECB3EEF  9.1     https://vulners.com/httpd/HTTPD:3512E3F62E72F03B59F5E9CF8ECB3EEF
|       HTTPD:2C227652EE0B3B961706AAFCACA3D1E1  9.1     https://vulners.com/httpd/HTTPD:2C227652EE0B3B961706AAFCACA3D1E1
|       FD2EE3A5-BAEA-5845-BA35-E6889992214F    9.1     https://vulners.com/githubexploit/FD2EE3A5-BAEA-5845-BA35-E6889992214F  *EXPLOIT*
|       FBC8A8BE-F00A-5B6D-832E-F99A72E7A3F7    9.1     https://vulners.com/githubexploit/FBC8A8BE-F00A-5B6D-832E-F99A72E7A3F7  *EXPLOIT*
|       E606D7F4-5FA2-5907-B30E-367D6FFECD89    9.1     https://vulners.com/githubexploit/E606D7F4-5FA2-5907-B30E-367D6FFECD89  *EXPLOIT*
|       D8A19443-2A37-5592-8955-F614504AAF45    9.1     https://vulners.com/githubexploit/D8A19443-2A37-5592-8955-F614504AAF45  *EXPLOIT*
|       CVE-2026-89282  9.1     https://vulners.com/cve/CVE-2026-89282
|       CVE-2026-42535  9.1     https://vulners.com/cve/CVE-2026-42535
|       CVE-2024-40898  9.1     https://vulners.com/cve/CVE-2024-40898
|       CVE-2024-38475  9.1     https://vulners.com/cve/CVE-2024-38475
|       CVE-2022-28615  9.1     https://vulners.com/cve/CVE-2022-28615
|       CVE-2022-22721  9.1     https://vulners.com/cve/CVE-2022-22721
|       CVE-2019-10082  9.1     https://vulners.com/cve/CVE-2019-10082
|       CNVD-2024-36387 9.1     https://vulners.com/cnvd/CNVD-2024-36387
|       CNVD-2024-33814 9.1     https://vulners.com/cnvd/CNVD-2024-33814
|       CNVD-2022-51060 9.1     https://vulners.com/cnvd/CNVD-2022-51060
|       CNVD-2022-41638 9.1     https://vulners.com/cnvd/CNVD-2022-41638
|       B5E74010-A082-5ECE-AB37-623A5B33FE7D    9.1     https://vulners.com/githubexploit/B5E74010-A082-5ECE-AB37-623A5B33FE7D  *EXPLOIT*
|       704E98B8-3443-5ACE-B86E-C5DB7C712E71    9.1     https://vulners.com/githubexploit/704E98B8-3443-5ACE-B86E-C5DB7C712E71  *EXPLOIT*
|       5418A85B-F4B7-5BBD-B106-0800AC961C7A    9.1     https://vulners.com/githubexploit/5418A85B-F4B7-5BBD-B106-0800AC961C7A  *EXPLOIT*
|       HTTPD:1B3D546A8500818AAC5B1359FE11A7E4  9.0     https://vulners.com/httpd/HTTPD:1B3D546A8500818AAC5B1359FE11A7E4
|       CVE-2022-36760  9.0     https://vulners.com/cve/CVE-2022-36760
|       CVE-2021-40438  9.0     https://vulners.com/cve/CVE-2021-40438
|       CNVD-2023-30860 9.0     https://vulners.com/cnvd/CNVD-2023-30860
|       CNVD-2022-03224 9.0     https://vulners.com/cnvd/CNVD-2022-03224
|       AE3EF1CC-A0C3-5CB7-A6EF-4DAAAFA59C8C    9.0     https://vulners.com/githubexploit/AE3EF1CC-A0C3-5CB7-A6EF-4DAAAFA59C8C  *EXPLOIT*
|       9D9B3F4D-6B5C-5377-BE39-F1C432C9E457    9.0     https://vulners.com/githubexploit/9D9B3F4D-6B5C-5377-BE39-F1C432C9E457  *EXPLOIT*
|       8AFB43C5-ABD4-52AD-BB19-24D7884FF2A2    9.0     https://vulners.com/githubexploit/8AFB43C5-ABD4-52AD-BB19-24D7884FF2A2  *EXPLOIT*
|       7F48C6CF-47B2-5AF9-B6FD-1735FB2A95B2    9.0     https://vulners.com/githubexploit/7F48C6CF-47B2-5AF9-B6FD-1735FB2A95B2  *EXPLOIT*
|       36618CA8-9316-59CA-B748-82F15F407C4F    9.0     https://vulners.com/githubexploit/36618CA8-9316-59CA-B748-82F15F407C4F  *EXPLOIT*
|       MEND:CVE-2026-93546     8.8     https://vulners.com/mend/MEND:CVE-2026-93546
|       MEND:CVE-2026-24072     8.8     https://vulners.com/mend/MEND:CVE-2026-24072
|       D6E5CEC7-9ED8-5F96-A93E-768E2674DBCB    8.8     https://vulners.com/githubexploit/D6E5CEC7-9ED8-5F96-A93E-768E2674DBCB  *EXPLOIT*
|       CVE-2026-93546  8.8     https://vulners.com/cve/CVE-2026-93546
|       CVE-2026-24072  8.8     https://vulners.com/cve/CVE-2026-24072
|       40379BCA-07F4-5401-B618-4640793D350D    8.8     https://vulners.com/githubexploit/40379BCA-07F4-5401-B618-4640793D350D  *EXPLOIT*
|       MEND:CVE-2026-63686     8.7     https://vulners.com/mend/MEND:CVE-2026-63686
|       MEND:CVE-2026-63292     8.7     https://vulners.com/mend/MEND:CVE-2026-63292
|       MEND:CVE-2026-63045     8.7     https://vulners.com/mend/MEND:CVE-2026-63045
|       MEND:CVE-2026-59685     8.7     https://vulners.com/mend/MEND:CVE-2026-59685
|       MEND:CVE-2026-56153     8.7     https://vulners.com/mend/MEND:CVE-2026-56153
|       MEND:CVE-2026-49975     8.7     https://vulners.com/mend/MEND:CVE-2026-49975
|       MEND:CVE-2026-48005     8.7     https://vulners.com/mend/MEND:CVE-2026-48005
|       MEND:CVE-2026-47360     8.7     https://vulners.com/mend/MEND:CVE-2026-47360
|       MEND:CVE-2026-46729     8.7     https://vulners.com/mend/MEND:CVE-2026-46729
|       MEND:CVE-2026-42536     8.7     https://vulners.com/mend/MEND:CVE-2026-42536
|       MEND:CVE-2026-34356     8.7     https://vulners.com/mend/MEND:CVE-2026-34356
|       MEND:CVE-2026-34355     8.7     https://vulners.com/mend/MEND:CVE-2026-34355
|       MEND:CVE-2026-34059     8.7     https://vulners.com/mend/MEND:CVE-2026-34059
|       MEND:CVE-2026-29169     8.7     https://vulners.com/mend/MEND:CVE-2026-29169
|       MEND:CVE-2025-59775     8.7     https://vulners.com/mend/MEND:CVE-2025-59775
|       MEND:CVE-2025-58098     8.7     https://vulners.com/mend/MEND:CVE-2025-58098
|       MEND:CVE-2025-53020     8.7     https://vulners.com/mend/MEND:CVE-2025-53020
|       MEND:CVE-2025-49630     8.7     https://vulners.com/mend/MEND:CVE-2025-49630
|       MEND:CVE-2024-47252     8.7     https://vulners.com/mend/MEND:CVE-2024-47252
|       MEND:CVE-2024-43204     8.7     https://vulners.com/mend/MEND:CVE-2024-43204
|       MEND:CVE-2024-42516     8.7     https://vulners.com/mend/MEND:CVE-2024-42516
|       CVE-2026-89281  8.4     https://vulners.com/cve/CVE-2026-89281
|       CVE-2025-58098  8.3     https://vulners.com/cve/CVE-2025-58098
|       HTTPD:A7133572D328CD65C350E33F20834FAD  8.2     https://vulners.com/httpd/HTTPD:A7133572D328CD65C350E33F20834FAD
|       CVE-2021-44224  8.2     https://vulners.com/cve/CVE-2021-44224
|       CNVD-2021-102387        8.2     https://vulners.com/cnvd/CNVD-2021-102387
|       B0A9E5E8-7CCC-5984-9922-A89F11D6BF38    8.2     https://vulners.com/githubexploit/B0A9E5E8-7CCC-5984-9922-A89F11D6BF38  *EXPLOIT*
|       HTTPD:B63E69E936F944F114293D6F4AB8D4D6  8.1     https://vulners.com/httpd/HTTPD:B63E69E936F944F114293D6F4AB8D4D6
|       CVE-2026-73636  8.1     https://vulners.com/cve/CVE-2026-73636
|       CVE-2024-38473  8.1     https://vulners.com/cve/CVE-2024-38473
|       CVE-2017-15715  8.1     https://vulners.com/cve/CVE-2017-15715
|       23079A70-8B37-56D2-9D37-F638EBF7F8B5    8.1     https://vulners.com/githubexploit/23079A70-8B37-56D2-9D37-F638EBF7F8B5  *EXPLOIT*
|       HTTPD:4CB68AD1C4AC4E8EE009A960A68B7E65  7.8     https://vulners.com/httpd/HTTPD:4CB68AD1C4AC4E8EE009A960A68B7E65
|       HTTPD:109158785130C454EF1D1CDDD4417560  7.8     https://vulners.com/httpd/HTTPD:109158785130C454EF1D1CDDD4417560
|       EDB-ID:46676    7.8     https://vulners.com/exploitdb/EDB-ID:46676      *EXPLOIT*
|       CVE-2019-9517   7.8     https://vulners.com/cve/CVE-2019-9517
|       CVE-2019-0211   7.8     https://vulners.com/cve/CVE-2019-0211
|       CNVD-2019-08946 7.8     https://vulners.com/cnvd/CNVD-2019-08946
|       88CDF499-CBE3-57E2-AB63-71E9CAA42B22    7.8     https://vulners.com/githubexploit/88CDF499-CBE3-57E2-AB63-71E9CAA42B22  *EXPLOIT*
|       706A08EF-16F2-59B5-B98E-EB8B83215AB1    7.8     https://vulners.com/gitee/706A08EF-16F2-59B5-B98E-EB8B83215AB1  *EXPLOIT*
|       HTTPD:F6C47B71D440F1A5B8EC9883D1516A33  7.5     https://vulners.com/httpd/HTTPD:F6C47B71D440F1A5B8EC9883D1516A33
|       HTTPD:F1CFBC9B54DFAD0499179863D36830BB  7.5     https://vulners.com/httpd/HTTPD:F1CFBC9B54DFAD0499179863D36830BB
|       HTTPD:D9B9375C40939357C5F47F1B3F64F0A1  7.5     https://vulners.com/httpd/HTTPD:D9B9375C40939357C5F47F1B3F64F0A1
|       HTTPD:D5C9AD5E120B9B567832B4A5DBD97F43  7.5     https://vulners.com/httpd/HTTPD:D5C9AD5E120B9B567832B4A5DBD97F43
|       HTTPD:CEEECD1BF3428B58C39137059390E4A1  7.5     https://vulners.com/httpd/HTTPD:CEEECD1BF3428B58C39137059390E4A1
|       HTTPD:C7D6319965E27EC08FB443D1FD67603B  7.5     https://vulners.com/httpd/HTTPD:C7D6319965E27EC08FB443D1FD67603B
|       HTTPD:C317C7138B4A8BBD54A901D6DDDCB837  7.5     https://vulners.com/httpd/HTTPD:C317C7138B4A8BBD54A901D6DDDCB837
|       HTTPD:C1F57FDC580B58497A5EC5B7D3749F2F  7.5     https://vulners.com/httpd/HTTPD:C1F57FDC580B58497A5EC5B7D3749F2F
|       HTTPD:B1B0A31C4AD388CC6C575931414173E2  7.5     https://vulners.com/httpd/HTTPD:B1B0A31C4AD388CC6C575931414173E2
|       HTTPD:975FD708E753E143E7DFFC23510F802E  7.5     https://vulners.com/httpd/HTTPD:975FD708E753E143E7DFFC23510F802E
|       HTTPD:708DA551D11D790335A6621D3875C0F4  7.5     https://vulners.com/httpd/HTTPD:708DA551D11D790335A6621D3875C0F4
|       HTTPD:63F2722DB00DBB3F59C40B40F32363B3  7.5     https://vulners.com/httpd/HTTPD:63F2722DB00DBB3F59C40B40F32363B3
|       HTTPD:60420623F2A716909480F87DB74EE9D7  7.5     https://vulners.com/httpd/HTTPD:60420623F2A716909480F87DB74EE9D7
|       HTTPD:5E6BCDB2F7C53E4EDCE844709D930AF5  7.5     https://vulners.com/httpd/HTTPD:5E6BCDB2F7C53E4EDCE844709D930AF5
|       HTTPD:05E6BF2AD317E3658D2938931207AA66  7.5     https://vulners.com/httpd/HTTPD:05E6BF2AD317E3658D2938931207AA66
|       EDEE9204-2DB4-5931-983F-6C7DB7FD4FB7    7.5     https://vulners.com/githubexploit/EDEE9204-2DB4-5931-983F-6C7DB7FD4FB7  *EXPLOIT*
|       CVE-2026-63686  7.5     https://vulners.com/cve/CVE-2026-63686
|       CVE-2026-63292  7.5     https://vulners.com/cve/CVE-2026-63292
|       CVE-2026-63045  7.5     https://vulners.com/cve/CVE-2026-63045
|       CVE-2026-59685  7.5     https://vulners.com/cve/CVE-2026-59685
|       CVE-2026-56449  7.5     https://vulners.com/cve/CVE-2026-56449
|       CVE-2026-56153  7.5     https://vulners.com/cve/CVE-2026-56153
|       CVE-2026-49975  7.5     https://vulners.com/cve/CVE-2026-49975
|       CVE-2026-48005  7.5     https://vulners.com/cve/CVE-2026-48005
|       CVE-2026-46729  7.5     https://vulners.com/cve/CVE-2026-46729
|       CVE-2026-42536  7.5     https://vulners.com/cve/CVE-2026-42536
|       CVE-2026-34356  7.5     https://vulners.com/cve/CVE-2026-34356
|       CVE-2026-34355  7.5     https://vulners.com/cve/CVE-2026-34355
|       CVE-2026-34059  7.5     https://vulners.com/cve/CVE-2026-34059
|       CVE-2026-29169  7.5     https://vulners.com/cve/CVE-2026-29169
|       CVE-2025-59775  7.5     https://vulners.com/cve/CVE-2025-59775
|       CVE-2025-53020  7.5     https://vulners.com/cve/CVE-2025-53020
|       CVE-2025-49630  7.5     https://vulners.com/cve/CVE-2025-49630
|       CVE-2024-47252  7.5     https://vulners.com/cve/CVE-2024-47252
|       CVE-2024-43394  7.5     https://vulners.com/cve/CVE-2024-43394
|       CVE-2024-43204  7.5     https://vulners.com/cve/CVE-2024-43204
|       CVE-2024-42516  7.5     https://vulners.com/cve/CVE-2024-42516
|       CVE-2024-39573  7.5     https://vulners.com/cve/CVE-2024-39573
|       CVE-2024-38477  7.5     https://vulners.com/cve/CVE-2024-38477
|       CVE-2024-38472  7.5     https://vulners.com/cve/CVE-2024-38472
|       CVE-2024-27316  7.5     https://vulners.com/cve/CVE-2024-27316
|       CVE-2023-31122  7.5     https://vulners.com/cve/CVE-2023-31122
|       CVE-2022-30556  7.5     https://vulners.com/cve/CVE-2022-30556
|       CVE-2022-29404  7.5     https://vulners.com/cve/CVE-2022-29404
|       CVE-2022-26377  7.5     https://vulners.com/cve/CVE-2022-26377
|       CVE-2022-22719  7.5     https://vulners.com/cve/CVE-2022-22719
|       CVE-2021-34798  7.5     https://vulners.com/cve/CVE-2021-34798
|       CVE-2021-33193  7.5     https://vulners.com/cve/CVE-2021-33193
|       CVE-2021-26690  7.5     https://vulners.com/cve/CVE-2021-26690
|       CVE-2020-9490   7.5     https://vulners.com/cve/CVE-2020-9490
|       CVE-2020-11993  7.5     https://vulners.com/cve/CVE-2020-11993
|       CVE-2019-10081  7.5     https://vulners.com/cve/CVE-2019-10081
|       CVE-2019-0217   7.5     https://vulners.com/cve/CVE-2019-0217
|       CVE-2018-17199  7.5     https://vulners.com/cve/CVE-2018-17199
|       CVE-2018-1333   7.5     https://vulners.com/cve/CVE-2018-1333
|       CVE-2018-1303   7.5     https://vulners.com/cve/CVE-2018-1303
|       CVE-2017-15710  7.5     https://vulners.com/cve/CVE-2017-15710
|       CVE-2006-20001  7.5     https://vulners.com/cve/CVE-2006-20001
|       CNVD-2025-30836 7.5     https://vulners.com/cnvd/CNVD-2025-30836
|       CNVD-2025-16614 7.5     https://vulners.com/cnvd/CNVD-2025-16614
|       CNVD-2025-16613 7.5     https://vulners.com/cnvd/CNVD-2025-16613
|       CNVD-2025-16612 7.5     https://vulners.com/cnvd/CNVD-2025-16612
|       CNVD-2025-16609 7.5     https://vulners.com/cnvd/CNVD-2025-16609
|       CNVD-2025-16608 7.5     https://vulners.com/cnvd/CNVD-2025-16608
|       CNVD-2025-16603 7.5     https://vulners.com/cnvd/CNVD-2025-16603
|       CNVD-2024-36393 7.5     https://vulners.com/cnvd/CNVD-2024-36393
|       CNVD-2024-36390 7.5     https://vulners.com/cnvd/CNVD-2024-36390
|       CNVD-2024-36389 7.5     https://vulners.com/cnvd/CNVD-2024-36389
|       CNVD-2024-20839 7.5     https://vulners.com/cnvd/CNVD-2024-20839
|       CNVD-2023-93320 7.5     https://vulners.com/cnvd/CNVD-2023-93320
|       CNVD-2023-80558 7.5     https://vulners.com/cnvd/CNVD-2023-80558
|       CNVD-2022-53584 7.5     https://vulners.com/cnvd/CNVD-2022-53584
|       CNVD-2022-51058 7.5     https://vulners.com/cnvd/CNVD-2022-51058
|       CNVD-2022-41639 7.5     https://vulners.com/cnvd/CNVD-2022-41639
|       CNVD-2022-13199 7.5     https://vulners.com/cnvd/CNVD-2022-13199
|       CNVD-2022-03223 7.5     https://vulners.com/cnvd/CNVD-2022-03223
|       CNVD-2020-46281 7.5     https://vulners.com/cnvd/CNVD-2020-46281
|       CNVD-2020-46279 7.5     https://vulners.com/cnvd/CNVD-2020-46279
|       CNVD-2019-41283 7.5     https://vulners.com/cnvd/CNVD-2019-41283
|       CNVD-2019-08945 7.5     https://vulners.com/cnvd/CNVD-2019-08945
|       CNVD-2018-25796 7.5     https://vulners.com/cnvd/CNVD-2018-25796
|       CDC791CD-A414-5ABE-A897-7CFA3C2D3D29    7.5     https://vulners.com/githubexploit/CDC791CD-A414-5ABE-A897-7CFA3C2D3D29  *EXPLOIT*
|       C2EB4AA1-0C70-5104-AF4C-BC274F5A5B7A    7.5     https://vulners.com/githubexploit/C2EB4AA1-0C70-5104-AF4C-BC274F5A5B7A  *EXPLOIT*
|       A5675239-3520-5F86-A975-8C0FBB77C2A9    7.5     https://vulners.com/githubexploit/A5675239-3520-5F86-A975-8C0FBB77C2A9  *EXPLOIT*
|       A0F268C8-7319-5637-82F7-8DAF72D14629    7.5     https://vulners.com/githubexploit/A0F268C8-7319-5637-82F7-8DAF72D14629  *EXPLOIT*
|       92C0957A-F7CF-5B24-B6B3-B6B5F0C22EC9    7.5     https://vulners.com/githubexploit/92C0957A-F7CF-5B24-B6B3-B6B5F0C22EC9  *EXPLOIT*
|       8A1A8D98-62D2-5A2D-8D42-694C66E0D1C4    7.5     https://vulners.com/githubexploit/8A1A8D98-62D2-5A2D-8D42-694C66E0D1C4  *EXPLOIT*
|       870911BF-5AC6-5253-9C61-EEB55CC505CC    7.5     https://vulners.com/githubexploit/870911BF-5AC6-5253-9C61-EEB55CC505CC  *EXPLOIT*
|       83A428C4-BFA1-573B-A05F-7E0A55E119C5    7.5     https://vulners.com/githubexploit/83A428C4-BFA1-573B-A05F-7E0A55E119C5  *EXPLOIT*
|       742112F7-4755-5E94-8DD2-899160B59E5E    7.5     https://vulners.com/githubexploit/742112F7-4755-5E94-8DD2-899160B59E5E  *EXPLOIT*
|       5B7082BE-022C-5DCA-BCDA-0F8EDD0E5085    7.5     https://vulners.com/githubexploit/5B7082BE-022C-5DCA-BCDA-0F8EDD0E5085  *EXPLOIT*
|       4B051C78-13E6-52F9-A39E-4C7E49ACB51A    7.5     https://vulners.com/githubexploit/4B051C78-13E6-52F9-A39E-4C7E49ACB51A  *EXPLOIT*
|       45D138AD-BEC6-552A-91EA-8816914CA7F4    7.5     https://vulners.com/githubexploit/45D138AD-BEC6-552A-91EA-8816914CA7F4  *EXPLOIT*
|       238D27D0-2B6D-59DE-B1AC-12B79D1C507C    7.5     https://vulners.com/githubexploit/238D27D0-2B6D-59DE-B1AC-12B79D1C507C  *EXPLOIT*
|       1337DAY-ID-35422        7.5     https://vulners.com/zdt/1337DAY-ID-35422        *EXPLOIT*
|       0E08753E-C6D7-5E76-A61F-6CA6F7F87AA8    7.5     https://vulners.com/githubexploit/0E08753E-C6D7-5E76-A61F-6CA6F7F87AA8  *EXPLOIT*
|       CVE-2025-49812  7.4     https://vulners.com/cve/CVE-2025-49812
|       B4DBC08B-FD86-5033-9708-4924C993CEDA    7.4     https://vulners.com/githubexploit/B4DBC08B-FD86-5033-9708-4924C993CEDA  *EXPLOIT*
|       MEND:CVE-2026-73637     7.3     https://vulners.com/mend/MEND:CVE-2026-73637
|       MEND:CVE-2026-44186     7.3     https://vulners.com/mend/MEND:CVE-2026-44186
|       MEND:CVE-2026-44185     7.3     https://vulners.com/mend/MEND:CVE-2026-44185
|       HTTPD:D66D5F45690EBE82B48CC81EF6388EE8  7.3     https://vulners.com/httpd/HTTPD:D66D5F45690EBE82B48CC81EF6388EE8
|       CVE-2026-73637  7.3     https://vulners.com/cve/CVE-2026-73637
|       CVE-2026-44186  7.3     https://vulners.com/cve/CVE-2026-44186
|       CVE-2026-44185  7.3     https://vulners.com/cve/CVE-2026-44185
|       CVE-2023-38709  7.3     https://vulners.com/cve/CVE-2023-38709
|       CVE-2020-35452  7.3     https://vulners.com/cve/CVE-2020-35452
|       CNVD-2024-36395 7.3     https://vulners.com/cnvd/CNVD-2024-36395
|       EXPLOITPACK:44C5118F831D55FAF4259C41D8BDA0AB    7.2     https://vulners.com/exploitpack/EXPLOITPACK:44C5118F831D55FAF4259C41D8BDA0AB    *EXPLOIT*
|       1337DAY-ID-32502        7.2     https://vulners.com/zdt/1337DAY-ID-32502        *EXPLOIT*
|       MEND:CVE-2026-79768     6.9     https://vulners.com/mend/MEND:CVE-2026-79768
|       MEND:CVE-2026-58415     6.9     https://vulners.com/mend/MEND:CVE-2026-58415
|       MEND:CVE-2026-43951     6.9     https://vulners.com/mend/MEND:CVE-2026-43951
|       MEND:CVE-2026-34032     6.9     https://vulners.com/mend/MEND:CVE-2026-34032
|       MEND:CVE-2026-33857     6.9     https://vulners.com/mend/MEND:CVE-2026-33857
|       MEND:CVE-2026-33523     6.9     https://vulners.com/mend/MEND:CVE-2026-33523
|       MEND:CVE-2026-33007     6.9     https://vulners.com/mend/MEND:CVE-2026-33007
|       MEND:CVE-2025-65082     6.9     https://vulners.com/mend/MEND:CVE-2025-65082
|       MEND:CVE-2026-44119     6.8     https://vulners.com/mend/MEND:CVE-2026-44119
|       CVE-2026-43951  6.5     https://vulners.com/cve/CVE-2026-43951
|       CVE-2026-33523  6.5     https://vulners.com/cve/CVE-2026-33523
|       CVE-2025-65082  6.5     https://vulners.com/cve/CVE-2025-65082
|       CNVD-2025-30833 6.5     https://vulners.com/cnvd/CNVD-2025-30833
|       MEND:CVE-2026-33006     6.3     https://vulners.com/mend/MEND:CVE-2026-33006
|       CVE-2024-24795  6.3     https://vulners.com/cve/CVE-2024-24795
|       CNVD-2024-36394 6.3     https://vulners.com/cnvd/CNVD-2024-36394
|       MEND:CVE-2026-29170     6.1     https://vulners.com/mend/MEND:CVE-2026-29170
|       KS:SCANNER-HTTP-CVE_2019_10098_DETECT   6.1     https://vulners.com/kittysploit/KS:SCANNER-HTTP-CVE_2019_10098_DETECT   *EXPLOIT*
|       KS:SCANNER-HTTP-CVE_2019_10092_DETECT   6.1     https://vulners.com/kittysploit/KS:SCANNER-HTTP-CVE_2019_10092_DETECT   *EXPLOIT*
|       HTTPD:E3E8BE7E36621C4506552BA051ECC3C8  6.1     https://vulners.com/httpd/HTTPD:E3E8BE7E36621C4506552BA051ECC3C8
|       HTTPD:8DF9389A321028B4475CE2E9B5BFC7A6  6.1     https://vulners.com/httpd/HTTPD:8DF9389A321028B4475CE2E9B5BFC7A6
|       HTTPD:5FF2D6B51D8115FFCB653949D8D36345  6.1     https://vulners.com/httpd/HTTPD:5FF2D6B51D8115FFCB653949D8D36345
|       EDB-ID:47689    6.1     https://vulners.com/exploitdb/EDB-ID:47689      *EXPLOIT*
|       EDB-ID:47688    6.1     https://vulners.com/exploitdb/EDB-ID:47688      *EXPLOIT*
|       CVE-2026-29170  6.1     https://vulners.com/cve/CVE-2026-29170
|       CVE-2020-1927   6.1     https://vulners.com/cve/CVE-2020-1927
|       CVE-2019-10098  6.1     https://vulners.com/cve/CVE-2019-10098
|       CVE-2019-10092  6.1     https://vulners.com/cve/CVE-2019-10092
|       CNVD-2020-21904 6.1     https://vulners.com/cnvd/CNVD-2020-21904
|       CAB023BA-58A3-5C35-BF97-F9C43133DB5E    6.1     https://vulners.com/gitee/CAB023BA-58A3-5C35-BF97-F9C43133DB5E  *EXPLOIT*
|       4013EC74-B3C1-5D95-938A-54197A58586D    6.1     https://vulners.com/githubexploit/4013EC74-B3C1-5D95-938A-54197A58586D  *EXPLOIT*
|       HTTPD:BC9528EF49BF5C3A4F7A85994496ACD5  5.9     https://vulners.com/httpd/HTTPD:BC9528EF49BF5C3A4F7A85994496ACD5
|       HTTPD:87E6488B7C543F4421D1060636F72213  5.9     https://vulners.com/httpd/HTTPD:87E6488B7C543F4421D1060636F72213
|       HTTPD:5C83890838E7C6903630B41EC3F2540D  5.9     https://vulners.com/httpd/HTTPD:5C83890838E7C6903630B41EC3F2540D
|       CVE-2023-45802  5.9     https://vulners.com/cve/CVE-2023-45802
|       CVE-2018-1302   5.9     https://vulners.com/cve/CVE-2018-1302
|       CVE-2018-1301   5.9     https://vulners.com/cve/CVE-2018-1301
|       CVE-2018-11763  5.9     https://vulners.com/cve/CVE-2018-11763
|       CNVD-2018-20078 5.9     https://vulners.com/cnvd/CNVD-2018-20078
|       CNVD-2018-06536 5.9     https://vulners.com/cnvd/CNVD-2018-06536
|       CNVD-2018-06535 5.9     https://vulners.com/cnvd/CNVD-2018-06535
|       556687CB-7B66-53C5-A79C-84B0ED753C7E    5.9     https://vulners.com/githubexploit/556687CB-7B66-53C5-A79C-84B0ED753C7E  *EXPLOIT*
|       1337DAY-ID-33577        5.8     https://vulners.com/zdt/1337DAY-ID-33577        *EXPLOIT*
|       HTTPD:B900BFA5C32A54AB9D565F59C8AC1D05  5.5     https://vulners.com/httpd/HTTPD:B900BFA5C32A54AB9D565F59C8AC1D05
|       CVE-2026-44119  5.5     https://vulners.com/cve/CVE-2026-44119
|       CVE-2020-13938  5.5     https://vulners.com/cve/CVE-2020-13938
|       CNVD-2021-44765 5.5     https://vulners.com/cnvd/CNVD-2021-44765
|       MEND:CVE-2025-66200     5.4     https://vulners.com/mend/MEND:CVE-2025-66200
|       CVE-2025-66200  5.4     https://vulners.com/cve/CVE-2025-66200
|       CNVD-2025-30835 5.4     https://vulners.com/cnvd/CNVD-2025-30835
|       MEND:CVE-2026-42528     5.3     https://vulners.com/mend/MEND:CVE-2026-42528
|       HTTPD:FCCF5DB14D66FA54B47C34D9680C0335  5.3     https://vulners.com/httpd/HTTPD:FCCF5DB14D66FA54B47C34D9680C0335
|       HTTPD:EB26BC6B6E566C865F53A311FC1A6744  5.3     https://vulners.com/httpd/HTTPD:EB26BC6B6E566C865F53A311FC1A6744
|       HTTPD:C1BCB024FBDBA4C7909CE6FABA8E1422  5.3     https://vulners.com/httpd/HTTPD:C1BCB024FBDBA4C7909CE6FABA8E1422
|       HTTPD:BAAB4065D254D64A717E8A5C847C7BCA  5.3     https://vulners.com/httpd/HTTPD:BAAB4065D254D64A717E8A5C847C7BCA
|       HTTPD:AA09285A8811F9F8A1F82F45122331AD  5.3     https://vulners.com/httpd/HTTPD:AA09285A8811F9F8A1F82F45122331AD
|       HTTPD:8806CE4EFAA6A567C7FAD62778B6A46F  5.3     https://vulners.com/httpd/HTTPD:8806CE4EFAA6A567C7FAD62778B6A46F
|       HTTPD:5C8B0394DE17D1C29719B16CE00F475D  5.3     https://vulners.com/httpd/HTTPD:5C8B0394DE17D1C29719B16CE00F475D
|       HTTPD:25716876F18D7575B7A8778A4476ED9E  5.3     https://vulners.com/httpd/HTTPD:25716876F18D7575B7A8778A4476ED9E
|       CVE-2026-79768  5.3     https://vulners.com/cve/CVE-2026-79768
|       CVE-2026-58415  5.3     https://vulners.com/cve/CVE-2026-58415
|       CVE-2026-34032  5.3     https://vulners.com/cve/CVE-2026-34032
|       CVE-2026-33857  5.3     https://vulners.com/cve/CVE-2026-33857
|       CVE-2026-33007  5.3     https://vulners.com/cve/CVE-2026-33007
|       CVE-2022-37436  5.3     https://vulners.com/cve/CVE-2022-37436
|       CVE-2022-28614  5.3     https://vulners.com/cve/CVE-2022-28614
|       CVE-2022-28330  5.3     https://vulners.com/cve/CVE-2022-28330
|       CVE-2020-1934   5.3     https://vulners.com/cve/CVE-2020-1934
|       CVE-2019-17567  5.3     https://vulners.com/cve/CVE-2019-17567
|       CVE-2019-0220   5.3     https://vulners.com/cve/CVE-2019-0220
|       CVE-2019-0196   5.3     https://vulners.com/cve/CVE-2019-0196
|       CVE-2018-17189  5.3     https://vulners.com/cve/CVE-2018-17189
|       CVE-2018-1283   5.3     https://vulners.com/cve/CVE-2018-1283
|       CNVD-2023-30859 5.3     https://vulners.com/cnvd/CNVD-2023-30859
|       CNVD-2022-53582 5.3     https://vulners.com/cnvd/CNVD-2022-53582
|       CNVD-2022-51059 5.3     https://vulners.com/cnvd/CNVD-2022-51059
|       CNVD-2021-44766 5.3     https://vulners.com/cnvd/CNVD-2021-44766
|       CNVD-2020-46278 5.3     https://vulners.com/cnvd/CNVD-2020-46278
|       CNVD-2020-29872 5.3     https://vulners.com/cnvd/CNVD-2020-29872
|       CNVD-2019-08941 5.3     https://vulners.com/cnvd/CNVD-2019-08941
|       CNVD-2019-02938 5.3     https://vulners.com/cnvd/CNVD-2019-02938
|       EA6ADD14-D80B-5DC2-9991-1F9663E2D09F    4.8     https://vulners.com/githubexploit/EA6ADD14-D80B-5DC2-9991-1F9663E2D09F  *EXPLOIT*
|       CVE-2026-33006  4.8     https://vulners.com/cve/CVE-2026-33006
|       CVE-2026-42528  4.3     https://vulners.com/cve/CVE-2026-42528
|       1337DAY-ID-33575        4.3     https://vulners.com/zdt/1337DAY-ID-33575        *EXPLOIT*
|       CVE-2026-42356  3.7     https://vulners.com/cve/CVE-2026-42356
|       CDF59E85-8B42-5073-A637-B11580C962DE    3.7     https://vulners.com/githubexploit/CDF59E85-8B42-5073-A637-B11580C962DE  *EXPLOIT*
|       PACKETSTORM:152441      0.0     https://vulners.com/packetstorm/PACKETSTORM:152441      *EXPLOIT*
|       GHSA-XM48-VPF9-PGMX     0.0     https://vulners.com/github/GHSA-XM48-VPF9-PGMX
|_      74A7BA4E-D496-587B-A72A-FA0BE663F994    0.0     https://vulners.com/githubexploit/74A7BA4E-D496-587B-A72A-FA0BE663F994  *EXPLOIT*
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 110.86 seconds

NSE Script Potential Security Impact Purpose smb-vuln-ms17-010 RCE Checks for the EternalBlue (MS17-010) vulnerability. smb-vuln-cve-2017-7494 RCE Checks for the SambaCry vulnerability. smb-vuln-ms08-067 RCE Checks for the Windows SMB MS08-067 vulnerability. smb-webexec-exploit Remote Command Execution Exploit-oriented script for the WebExec vulnerability. smb-psexec Remote Command Execution Executes commands using valid administrative SMB credentials. smb-enum-shares Information Disclosure Enumerates SMB shares that may expose sensitive resources. smb-ls File Disclosure Lists files and directories in accessible SMB shares.

┌──(kali㉿kali)-[~/Desktop]
└─$ grep -ilE 'RCE|remote code execution|path traversal|directory traversal|file disclosure' /usr/share/nmap/scripts/*.nse
/usr/share/nmap/scripts/afp-path-vuln.nse
/usr/share/nmap/scripts/ajp-brute.nse
/usr/share/nmap/scripts/ajp-request.nse
/usr/share/nmap/scripts/allseeingeye-info.nse
/usr/share/nmap/scripts/backorifice-brute.nse
/usr/share/nmap/scripts/backorifice-info.nse
/usr/share/nmap/scripts/bacnet-info.nse
/usr/share/nmap/scripts/broadcast-dhcp-discover.nse
/usr/share/nmap/scripts/broadcast-igmp-discovery.nse
/usr/share/nmap/scripts/broadcast-listener.nse
/usr/share/nmap/scripts/broadcast-ospf2-discover.nse
/usr/share/nmap/scripts/broadcast-ping.nse
/usr/share/nmap/scripts/cassandra-brute.nse
/usr/share/nmap/scripts/citrix-enum-apps.nse
/usr/share/nmap/scripts/citrix-enum-apps-xml.nse
/usr/share/nmap/scripts/citrix-enum-servers.nse
/usr/share/nmap/scripts/coap-resources.nse
/usr/share/nmap/scripts/creds-summary.nse
/usr/share/nmap/scripts/cvs-brute.nse
/usr/share/nmap/scripts/cvs-brute-repository.nse
/usr/share/nmap/scripts/daap-get-library.nse
/usr/share/nmap/scripts/deluge-rpc-brute.nse
/usr/share/nmap/scripts/dicom-brute.nse
/usr/share/nmap/scripts/dicom-ping.nse
/usr/share/nmap/scripts/distcc-cve2004-2687.nse
/usr/share/nmap/scripts/dns-brute.nse
/usr/share/nmap/scripts/dns-nsec3-enum.nse
/usr/share/nmap/scripts/dns-random-srcport.nse
/usr/share/nmap/scripts/dns-zone-transfer.nse
/usr/share/nmap/scripts/domcon-brute.nse
/usr/share/nmap/scripts/domino-enum-users.nse
/usr/share/nmap/scripts/dpap-brute.nse
/usr/share/nmap/scripts/drda-brute.nse
/usr/share/nmap/scripts/duplicates.nse
/usr/share/nmap/scripts/enip-info.nse
/usr/share/nmap/scripts/firewalk.nse
/usr/share/nmap/scripts/freelancer-info.nse
/usr/share/nmap/scripts/ftp-brute.nse
/usr/share/nmap/scripts/ganglia-info.nse
/usr/share/nmap/scripts/http-apache-negotiation.nse
/usr/share/nmap/scripts/http-avaya-ipoffice-users.nse
/usr/share/nmap/scripts/http-awstatstotals-exec.nse
/usr/share/nmap/scripts/http-axis2-dir-traversal.nse
/usr/share/nmap/scripts/http-barracuda-dir-traversal.nse
/usr/share/nmap/scripts/http-brute.nse
/usr/share/nmap/scripts/http-chrono.nse
/usr/share/nmap/scripts/http-cors.nse
/usr/share/nmap/scripts/http-cross-domain-policy.nse
/usr/share/nmap/scripts/http-devframework.nse
/usr/share/nmap/scripts/http-dombased-xss.nse
/usr/share/nmap/scripts/http-drupal-enum.nse
/usr/share/nmap/scripts/http-errors.nse
/usr/share/nmap/scripts/http-exif-spider.nse
/usr/share/nmap/scripts/http-feed.nse
/usr/share/nmap/scripts/http-form-brute.nse
/usr/share/nmap/scripts/http-form-fuzzer.nse
/usr/share/nmap/scripts/http-headers.nse
/usr/share/nmap/scripts/http-iis-short-name-brute.nse
/usr/share/nmap/scripts/http-iis-webdav-vuln.nse
/usr/share/nmap/scripts/http-joomla-brute.nse
/usr/share/nmap/scripts/http-jsonp-detection.nse
/usr/share/nmap/scripts/http-litespeed-sourcecode-download.nse
/usr/share/nmap/scripts/http-majordomo2-dir-traversal.nse
/usr/share/nmap/scripts/http-mcmp.nse
/usr/share/nmap/scripts/http-methods.nse
/usr/share/nmap/scripts/http-method-tamper.nse
/usr/share/nmap/scripts/http-ntlm-info.nse
/usr/share/nmap/scripts/http-passwd.nse
/usr/share/nmap/scripts/http-phpmyadmin-dir-traversal.nse
/usr/share/nmap/scripts/http-phpself-xss.nse
/usr/share/nmap/scripts/http-proxy-brute.nse
/usr/share/nmap/scripts/http-qnap-nas-info.nse
/usr/share/nmap/scripts/http-referer-checker.nse
/usr/share/nmap/scripts/http-security-headers.nse
/usr/share/nmap/scripts/http-slowloris-check.nse
/usr/share/nmap/scripts/http-slowloris.nse
/usr/share/nmap/scripts/http-title.nse
/usr/share/nmap/scripts/http-tplink-dir-traversal.nse
/usr/share/nmap/scripts/http-virustotal.nse
/usr/share/nmap/scripts/http-vmware-path-vuln.nse
/usr/share/nmap/scripts/http-vuln-cve2006-3392.nse
/usr/share/nmap/scripts/http-vuln-cve2010-0738.nse
/usr/share/nmap/scripts/http-vuln-cve2010-2861.nse
/usr/share/nmap/scripts/http-vuln-cve2012-1823.nse
/usr/share/nmap/scripts/http-vuln-cve2013-7091.nse
/usr/share/nmap/scripts/http-vuln-cve2014-3704.nse
/usr/share/nmap/scripts/http-vuln-cve2015-1427.nse
/usr/share/nmap/scripts/http-vuln-cve2015-1635.nse
/usr/share/nmap/scripts/http-vuln-cve2017-5638.nse
/usr/share/nmap/scripts/http-waf-fingerprint.nse
/usr/share/nmap/scripts/http-wordpress-brute.nse
/usr/share/nmap/scripts/http-wordpress-enum.nse
/usr/share/nmap/scripts/iax2-brute.nse
/usr/share/nmap/scripts/imap-brute.nse
/usr/share/nmap/scripts/impress-remote-discover.nse
/usr/share/nmap/scripts/informix-brute.nse
/usr/share/nmap/scripts/ip-https-discover.nse
/usr/share/nmap/scripts/ipmi-brute.nse
/usr/share/nmap/scripts/ipv6-ra-flood.nse
/usr/share/nmap/scripts/irc-brute.nse
/usr/share/nmap/scripts/irc-info.nse
/usr/share/nmap/scripts/irc-sasl-brute.nse
/usr/share/nmap/scripts/irc-unrealircd-backdoor.nse
/usr/share/nmap/scripts/iscsi-brute.nse
/usr/share/nmap/scripts/jdwp-exec.nse
/usr/share/nmap/scripts/jdwp-info.nse
/usr/share/nmap/scripts/knx-gateway-discover.nse
/usr/share/nmap/scripts/krb5-enum-users.nse
/usr/share/nmap/scripts/ldap-brute.nse
/usr/share/nmap/scripts/lexmark-config.nse
/usr/share/nmap/scripts/llmnr-resolve.nse
/usr/share/nmap/scripts/lltd-discovery.nse
/usr/share/nmap/scripts/lu-enum.nse
/usr/share/nmap/scripts/membase-brute.nse
/usr/share/nmap/scripts/metasploit-msgrpc-brute.nse
/usr/share/nmap/scripts/metasploit-xmlrpc-brute.nse
/usr/share/nmap/scripts/mikrotik-routeros-brute.nse
/usr/share/nmap/scripts/mmouse-brute.nse
/usr/share/nmap/scripts/mongodb-brute.nse
/usr/share/nmap/scripts/mqtt-subscribe.nse
/usr/share/nmap/scripts/mrinfo.nse
/usr/share/nmap/scripts/ms-sql-brute.nse
/usr/share/nmap/scripts/ms-sql-empty-password.nse
/usr/share/nmap/scripts/ms-sql-info.nse
/usr/share/nmap/scripts/ms-sql-ntlm-info.nse
/usr/share/nmap/scripts/mtrace.nse
/usr/share/nmap/scripts/murmur-version.nse
/usr/share/nmap/scripts/nessus-brute.nse
/usr/share/nmap/scripts/nessus-xmlrpc-brute.nse
/usr/share/nmap/scripts/netbus-brute.nse
/usr/share/nmap/scripts/nexpose-brute.nse
/usr/share/nmap/scripts/nfs-ls.nse
/usr/share/nmap/scripts/nfs-statfs.nse
/usr/share/nmap/scripts/nje-node-brute.nse
/usr/share/nmap/scripts/nje-pass-brute.nse
/usr/share/nmap/scripts/nping-brute.nse
/usr/share/nmap/scripts/ntp-monlist.nse
/usr/share/nmap/scripts/omp2-brute.nse
/usr/share/nmap/scripts/openflow-info.nse
/usr/share/nmap/scripts/openlookup-info.nse
/usr/share/nmap/scripts/openvas-otp-brute.nse
/usr/share/nmap/scripts/oracle-brute.nse
/usr/share/nmap/scripts/oracle-brute-stealth.nse
/usr/share/nmap/scripts/p2p-conficker.nse
/usr/share/nmap/scripts/path-mtu.nse
/usr/share/nmap/scripts/pcanywhere-brute.nse
/usr/share/nmap/scripts/pgsql-brute.nse
/usr/share/nmap/scripts/qscan.nse
/usr/share/nmap/scripts/quake1-info.nse
/usr/share/nmap/scripts/quake3-master-getservers.nse
/usr/share/nmap/scripts/rdp-vuln-ms12-020.nse
/usr/share/nmap/scripts/redis-brute.nse
/usr/share/nmap/scripts/rexec-brute.nse
/usr/share/nmap/scripts/rlogin-brute.nse
/usr/share/nmap/scripts/rmi-dumpregistry.nse
/usr/share/nmap/scripts/rmi-vuln-classloader.nse
/usr/share/nmap/scripts/rpcap-brute.nse
/usr/share/nmap/scripts/rsync-brute.nse
/usr/share/nmap/scripts/samba-vuln-cve-2012-1182.nse
/usr/share/nmap/scripts/servicetags.nse
/usr/share/nmap/scripts/sip-brute.nse
/usr/share/nmap/scripts/sip-call-spoof.nse
/usr/share/nmap/scripts/smb-brute.nse
/usr/share/nmap/scripts/smb-double-pulsar-backdoor.nse
/usr/share/nmap/scripts/smb-enum-sessions.nse
/usr/share/nmap/scripts/smb-enum-users.nse
/usr/share/nmap/scripts/smb-mbenum.nse
/usr/share/nmap/scripts/smb-psexec.nse
/usr/share/nmap/scripts/smb-security-mode.nse
/usr/share/nmap/scripts/smb-system-info.nse
/usr/share/nmap/scripts/smb-vuln-cve-2017-7494.nse
/usr/share/nmap/scripts/smb-vuln-ms07-029.nse
/usr/share/nmap/scripts/smb-vuln-ms08-067.nse
/usr/share/nmap/scripts/smb-vuln-ms17-010.nse
/usr/share/nmap/scripts/smb-vuln-webexec.nse
/usr/share/nmap/scripts/smtp-brute.nse
/usr/share/nmap/scripts/smtp-enum-users.nse
/usr/share/nmap/scripts/smtp-open-relay.nse
/usr/share/nmap/scripts/smtp-vuln-cve2010-4344.nse
/usr/share/nmap/scripts/smtp-vuln-cve2011-1764.nse
/usr/share/nmap/scripts/snmp-brute.nse
/usr/share/nmap/scripts/snmp-interfaces.nse
/usr/share/nmap/scripts/snmp-ios-config.nse
/usr/share/nmap/scripts/socks-brute.nse
/usr/share/nmap/scripts/ssh-brute.nse
/usr/share/nmap/scripts/ssl-ccs-injection.nse
/usr/share/nmap/scripts/ssl-dh-params.nse
/usr/share/nmap/scripts/sslv2-drown.nse
/usr/share/nmap/scripts/supermicro-ipmi-conf.nse
/usr/share/nmap/scripts/svn-brute.nse
/usr/share/nmap/scripts/targets-ipv6-eui64.nse
/usr/share/nmap/scripts/targets-ipv6-map4to6.nse
/usr/share/nmap/scripts/targets-ipv6-multicast-slaac.nse
/usr/share/nmap/scripts/targets-ipv6-wordlist.nse
/usr/share/nmap/scripts/telnet-brute.nse
/usr/share/nmap/scripts/tftp-version.nse
/usr/share/nmap/scripts/tls-alpn.nse
/usr/share/nmap/scripts/tso-brute.nse
/usr/share/nmap/scripts/ubiquiti-discovery.nse
/usr/share/nmap/scripts/vmauthd-brute.nse
/usr/share/nmap/scripts/vnc-brute.nse
/usr/share/nmap/scripts/vnc-title.nse
/usr/share/nmap/scripts/vtam-enum.nse
/usr/share/nmap/scripts/vulners.nse
/usr/share/nmap/scripts/vuze-dht-info.nse
/usr/share/nmap/scripts/wdb-version.nse
/usr/share/nmap/scripts/weblogic-t3-info.nse
/usr/share/nmap/scripts/whois-ip.nse
/usr/share/nmap/scripts/x11-access.nse
/usr/share/nmap/scripts/xmpp-brute.nse
/usr/share/nmap/scripts/xmpp-info.nse

Pasted image 20261101230741.png

Performance

Nmap scanning performance controls how quickly and aggressively Nmap sends probes to a target. For example, imagine you're scanning 1,000 servers over a slow network. Sending too many packets too quickly can cause packet loss, missed ports, or network congestion. These options help balance scanning speed and accuracy.

Nmap performance options

Option Purpose Real-life example -T0 to -T5 Controls overall scan timing and aggressiveness. T0 is extremely slow; T5 is very aggressive. Like driving: T0 is slow driving, while T5 is driving at maximum speed. --min-parallelism <number> Sets the minimum number of probes Nmap tries to keep active simultaneously. Instead of checking one room at a time, you inspect at least 10 rooms simultaneously. --max-rtt-timeout <time> Sets the maximum time Nmap waits for a probe response before treating it as timed out. If a person doesn't answer within 2 seconds, you stop waiting for that response. --min-rate <number> Sets the minimum target packet transmission rate per second. You want to send at least 500 inspection requests every second. --max-retries <number> Limits how many times Nmap retransmits a probe when it doesn't receive a response. If someone doesn't answer your first call, you retry only twice.

sudo nmap 10.129.2.0/24 -F | grep "/tcp" | wc -l  - Default Scan
sudo nmap 10.129.2.0/24 -F --max-retries 0 | grep "/tcp" | wc -l  - Reduce tries

Optimized Scan

sudo nmap 10.129.2.0/24 -F -oN tnet.minrate300 --min-rate 300

Scanning Options Description 10.129.2.0/24 Scans the specified target network. -F Scans top 100 ports. -oN tnet.minrate300 Saves the results in normal formats, starting the specified file name. --min-rate 300 Sets the minimum number of packets to be sent per second.

Timing

Because such settings cannot always be optimized manually, as in a black-box penetration test, Nmap offers six different timing templates (-T <0-5>) for us to use. These values (0-5) determine the aggressiveness of our scans. This can also have negative effects if the scan is too aggressive, and security systems may block us due to the produced network traffic. The default timing template used when we have defined nothing else is the normal (-T 3).

  • -T 0 / -T paranoid
  • -T 1 / -T sneaky
  • -T 2 / -T polite
  • -T 3 / -T normal
  • -T 4 / -T aggressive
  • -T 5 / -T insane

Firewall and IDS/IPS evasion techniques

Technique How it works Real-life example Packet Fragmentation (-f) Splits packets into smaller fragments to make inspection more difficult for some network security devices. Instead of delivering one complete document, you send it in several small pieces. Decoys (-D) Sends scan traffic using additional spoofed source IP addresses to obscure the actual scanner's identity. Several people enter together, making it harder to identify who initiated the activity. Source Port (-g) Uses a specified source port to influence how traffic is interpreted by filtering devices. Wearing a delivery-company uniform to make your arrival look like normal delivery traffic. Timing (-T) Controls scan speed and packet timing to reduce how obvious scan activity appears. Walking slowly through a building instead of rushing through every room. Data Length (--data-length) Adds extra data to probe packets to change their packet characteristics. Adding extra pages to a document so it doesn't look like a standard form.

996

Imagine a company office where a security guard monitors everyone entering the building. IDS works like a guard who watches CCTV footage, identifies suspicious behaviour and alerts the security team, but does not stop the person. IPS works like a guard who not only identifies suspicious behaviour but also blocks the person from entering.

In cybersecurity, when you run an Nmap scan against a company's server, it sends multiple connection requests to discover open ports and services. IDS analyses this network traffic and may recognise the scanning pattern through predefined signatures, generating an alert. IPS goes one step further by taking defensive action, such as dropping suspicious packets or blocking the source IP, to prevent further scanning attempts.

In simple terms: IDS detects and reports suspicious activity, whereas IPS detects and actively prevents it.

Determine Firewalls and Their Rules

Imagine you're trying to enter a company's office, but the security guard is controlling who can enter. If the guard silently ignores you and gives no response, that's Dropped. You don't know whether the office is closed or your entry was blocked. But if the guard clearly tells you that entry is prohibited, that's Rejected. In networking, when a firewall drops packets, it silently discards them without sending a response. When it rejects packets, it sends an explicit response explaining why the connection cannot proceed.

For example, when you scan a server using Nmap, a filtered port may be either dropped or rejected by a firewall.

Firewall response What happens Nmap observation Dropped Packet is silently discarded; no response is returned. Usually filtered due to no response or timeout. Rejected (TCP) Firewall sends a TCP packet with the RST flag. Usually filtered if the rejection indicates filtering. Rejected (ICMP) Firewall sends an ICMP error message. Usually filtered with an ICMP unreachable response

Common ICMP rejection messages

ICMP Error Simple meaning Net Unreachable The destination network cannot be reached. Net Prohibited Access to the destination network is prohibited. Host Unreachable The destination host cannot be reached. Host Prohibited Access to the destination host is prohibited. Port Unreachable The destination port cannot be reached or is unavailable. Proto Unreachable The requested network protocol is not supported or available.

Imagine you're entering a company's office from outside. The security guard blocks people trying to enter through the main entrance, but someone sends a signal saying, "I'm already inside; is this connection valid?" The guard may allow that signal because it looks like traffic belonging to an existing connection.

This is similar to how an Nmap TCP ACK scan (-sA) works. Unlike a SYN scan (-sS), which sends a SYN packet to initiate a connection, an ACK scan sends a TCP packet with only the ACK flag set. The target typically responds with an RST packet whether the port is open or closed. Nmap uses this response to determine whether a port is unfiltered or filtered, rather than identifying whether it is open or closed.

Scan type TCP flag sent Purpose SYN Scan (-sS) SYN Identifies open, closed or filtered ports. Connect Scan (-sT) Full TCP connection Attempts to establish a complete TCP connection. ACK Scan (-sA) ACK Determines whether ports are filtered or unfiltered.

Example command:

`sudo nmap -sA -p80,443 10.129.2.80

┌──(kali㉿kali)-[~/Desktop]
└─$ sudo nmap  10.129.2.80 -sA -p80,445
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-02 09:13 +0530
Nmap scan report for 10.129.2.80
Host is up (0.36s latency).
PORT    STATE      SERVICE
80/tcp  unfiltered http
445/tcp unfiltered microsoft-ds
Nmap done: 1 IP address (1 host up) scanned in 1.61 seconds

Nmap result Meaning unfiltered Target responded with RST; firewall did not filter the probe. filtered Probe was blocked or no response was received.

Remember: ACK scan does not tell you whether a port is open or closed. It helps identify firewall filtering behaviour. Also, ACK packets are not automatically allowed through firewalls; modern stateful firewalls can detect and block unsolicited ACK packets.

Another example here we can c when we use -sA which determine ports filtered open or unfiltered

┌──(kali㉿kali)-[~/Desktop]
└─$ sudo nmap -sA 192.178.158.113 -p445,139,88 -Pn
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-02 09:16 +0530
Nmap scan report for 192.178.158.113
Host is up (0.00020s latency).
PORT    STATE      SERVICE
88/tcp  unfiltered kerberos-sec
139/tcp unfiltered netbios-ssn
445/tcp unfiltered microsoft-ds
Nmap done: 1 IP address (1 host up) scanned in 808.75 seconds
┌──(kali㉿kali)-[~/Desktop]
└─$ sudo nmap -v 192.178.158.113 -p445,139,88 -Pn
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times may be slower.
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-02 09:30 +0530
Initiating Parallel DNS resolution of 1 host. at 09:30
Completed Parallel DNS resolution of 1 host. at 09:30, 0.06s elapsed
Initiating SYN Stealth Scan at 09:30
Scanning lcdels-in-f113.1e100.net (192.178.158.113) [3 ports]
Completed SYN Stealth Scan at 09:30, 3.02s elapsed (3 total ports)
Nmap scan report for lcdels-in-f113.1e100.net (192.178.158.113)
Host is up.
PORT    STATE    SERVICE
88/tcp  filtered kerberos-sec
139/tcp filtered netbios-ssn
445/tcp filtered microsoft-ds
Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 3.14 seconds
           Raw packets sent: 6 (264B) | Rcvd: 0 (0B)

At first its shows unfiltered which suppose to be port are open but another when we removed -sA and checked it shows filtered well that Imagine you're trying to enter a company's office. The security guard blocks everyone trying to enter through the main entrance (SYN request), so your entry request gets silently ignored. However, you send another signal that looks like you're responding to an existing conversation (ACK packet), and the guard responds with a rejection signal (RST), confirming that your packet reached the destination. This is similar to Nmap results: the SYN scan shows filtered because the firewall doesn't respond to the connection request, while the ACK scan shows unfiltered because the ACK probe receives a response. It tells us the firewall may be treating different TCP flags differently, but it does not tell us whether the ports are open or closed.

In simple terms: SYN scan asks, "Can I establish a connection?" while ACK scan asks, "Does my packet reach the destination without being filtered?"

Lets take a better example

──(kali㉿kali)-[~/Desktop]
└─$ sudo nmap  10.129.2.80  -sS -Pn -n --disable-arp-ping --packet-trace
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-02 09:36 +0530
SENT (0.0463s) TCP 10.10.17.199:50037 > 10.129.2.80:5900 S ttl=54 id=57515 iplen=44  seq=1244410244 win=1024 <mss 1460>
SENT (0.0464s) TCP 10.10.17.199:50037 > 10.129.2.80:3306 S ttl=52 id=12020 iplen=44  seq=1244410244 win=1024 <mss 1460>
SENT (0.0464s) TCP 10.10.17.199:50037 > 10.129.2.80:8888 S ttl=48 id=24974 iplen=44  seq=1244410244 win=1024 <mss 1460>
Nmap scan report for 10.129.2.80
Host is up (0.35s latency).
Not shown: 993 closed tcp ports (reset)
PORT      STATE SERVICE
22/tcp    open  ssh
80/tcp    open  http
110/tcp   open  pop3
139/tcp   open  netbios-ssn
143/tcp   open  imap
445/tcp   open  microsoft-ds
10001/tcp open  scp-config
Nmap done: 1 IP address (1 host up) scanned in 6.00 seconds
┌──(kali㉿kali)-[~/Desktop]
└─$ sudo nmap  10.129.2.80 -p 21,22,25 -sA -Pn -n --disable-arp-ping --packet-trace
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-02 09:38 +0530
SENT (0.0328s) TCP 10.10.17.199:60298 > 10.129.2.80:25 A ttl=54 id=45626 iplen=40  seq=0 win=1024
SENT (0.0328s) TCP 10.10.17.199:60298 > 10.129.2.80:22 A ttl=37 id=21434 iplen=40  seq=0 win=1024
SENT (0.0328s) TCP 10.10.17.199:60298 > 10.129.2.80:21 A ttl=56 id=22965 iplen=40  seq=0 win=1024
RCVD (0.3335s) TCP 10.129.2.80:25 > 10.10.17.199:60298 R ttl=63 id=0 iplen=40  seq=958407858 win=0
RCVD (0.6393s) TCP 10.129.2.80:22 > 10.10.17.199:60298 R ttl=63 id=0 iplen=40  seq=958407858 win=0
RCVD (0.9449s) TCP 10.129.2.80:21 > 10.10.17.199:60298 R ttl=63 id=0 iplen=40  seq=958407858 win=0
Nmap scan report for 10.129.2.80
Host is up (0.41s latency).
PORT   STATE      SERVICE
21/tcp unfiltered ftp
22/tcp unfiltered ssh
25/tcp unfiltered smtp
Nmap done: 1 IP address (1 host up) scanned in 0.98 seconds

Scanning Options Description 10.129.2.80 Scans the specified target. -p 21,22,25 Scans only the specified ports. -sS Performs SYN scan on specified ports. -sA Performs ACK scan on specified ports. -Pn Disables ICMP Echo requests. -n Disables DNS resolution. --disable-arp-ping Disables ARP ping. --packet-trace Shows all packets sent and received.

└─$ sudo nmap  10.129.2.80 -p 21,22,25 -sA -Pn -n --disable-arp-ping --packet-trace
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-02 09:38 +0530
SENT (0.0328s) TCP 10.10.17.199:60298 > 10.129.2.80:25 A ttl=54 id=45626 iplen=40  seq=0 win=1024
SENT (0.0328s) TCP 10.10.17.199:60298 > 10.129.2.80:22 A ttl=37 id=21434 iplen=40  seq=0 win=1024
SENT (0.0328s) TCP 10.10.17.199:60298 > 10.129.2.80:21 A ttl=56 id=22965 iplen=40  seq=0 win=1024
RCVD (0.3335s) TCP 10.129.2.80:25 > 10.10.17.199:60298 R ttl=63 id=0 iplen=40  seq=958407858 win=0
RCVD (0.6393s) TCP 10.129.2.80:22 > 10.10.17.199:60298 R ttl=63 id=0 iplen=40  seq=958407858 win=0
RCVD (0.9449s) TCP 10.129.2.80:21 > 10.10.17.199:60298 R ttl=63 id=0 iplen=40  seq=958407858 win=0
Nmap scan report for 10.129.2.80
Host is up (0.41s latency).
PORT   STATE      SERVICE
21/tcp unfiltered ftp
22/tcp unfiltered ssh
25/tcp unfiltered smtp
Nmap done: 1 IP address (1 host up) scanned in 0.98 seconds
┌──(kali㉿kali)-[~/Desktop]
└─$ sudo nmap  10.129.2.80 -p 21,22,25 -sS -Pn -n --disable-arp-ping --packet-trace
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-02 09:39 +0530
SENT (0.0521s) TCP 10.10.17.199:48166 > 10.129.2.80:25 S ttl=54 id=64492 iplen=44  seq=2090550128 win=1024 <mss 1460>
SENT (0.0521s) TCP 10.10.17.199:48166 > 10.129.2.80:22 S ttl=39 id=10158 iplen=44  seq=2090550128 win=1024 <mss 1460>
SENT (0.0522s) TCP 10.10.17.199:48166 > 10.129.2.80:21 S ttl=51 id=19054 iplen=44  seq=2090550128 win=1024 <mss 1460>
RCVD (0.3697s) TCP 10.129.2.80:25 > 10.10.17.199:48166 RA ttl=63 id=0 iplen=40  seq=0 win=0
RCVD (0.6761s) TCP 10.129.2.80:22 > 10.10.17.199:48166 SA ttl=63 id=0 iplen=44  seq=2870327576 win=64240 <mss 1346>
RCVD (0.9817s) TCP 10.129.2.80:21 > 10.10.17.199:48166 RA ttl=63 id=0 iplen=40  seq=0 win=0
Nmap scan report for 10.129.2.80
Host is up (0.43s latency).
PORT   STATE  SERVICE
21/tcp closed ftp
22/tcp open   ssh
25/tcp closed smtp
Nmap done: 1 IP address (1 host up) scanned in 1.02 seconds

Detect IDS/IPS

imagine you're investigating a company building, but you don't want the security team to identify exactly who is knocking on the door. Instead of sending people from your own address, you arrange for five other people to knock from different locations, while you also join them. This makes it harder for the security team to identify which person initiated the activity.

That's how Nmap Decoy scanning (-D) works: Nmap sends scan packets using multiple source IP addresses, including your real IP and decoy IPs. The target's monitoring system sees multiple apparent sources, making it harder to identify the actual scanner.

Nmap example

sudo nmap -sS -D RND:5 10.129.2.80

Parameter Meaning -sS Performs a TCP SYN scan. -D Enables decoy scanning. RND:5 Generates five random decoy IP addresses. 10.129.2.80 Target IP address.

Scan by Using Decoys

└─$ sudo nmap  10.129.2.80 -p 80 -sS -Pn -n --disable-arp-ping --packet-trace -D RND:5
[sudo] password for kali:
Sorry, try again.
[sudo] password for kali:
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-02 09:58 +0530
SENT (0.0367s) TCP 236.162.235.164:38952 > 10.129.2.80:80 S ttl=58 id=35010 iplen=44  seq=98112925 win=1024 <mss 1460>
SENT (0.0368s) TCP 155.55.153.66:38952 > 10.129.2.80:80 S ttl=44 id=35010 iplen=44  seq=98112925 win=1024 <mss 1460>
SENT (0.0368s) TCP 10.10.17.199:38952 > 10.129.2.80:80 S ttl=57 id=35010 iplen=44  seq=98112925 win=1024 <mss 1460>
SENT (0.0368s) TCP 192.133.220.200:38952 > 10.129.2.80:80 S ttl=55 id=35010 iplen=44  seq=98112925 win=1024 <mss 1460>
SENT (0.0368s) TCP 224.154.98.193:38952 > 10.129.2.80:80 S ttl=53 id=35010 iplen=44  seq=98112925 win=1024 <mss 1460>
SENT (0.0368s) TCP 191.61.26.184:38952 > 10.129.2.80:80 S ttl=45 id=35010 iplen=44  seq=98112925 win=1024 <mss 1460>
RCVD (0.6074s) TCP 10.129.2.80:80 > 10.10.17.199:38952 SA ttl=63 id=0 iplen=44  seq=3012375503 win=64240 <mss 1346>
Nmap scan report for 10.129.2.80
Host is up (0.57s latency).
PORT   STATE SERVICE
80/tcp open  http
Nmap done: 1 IP address (1 host up) scanned in 0.64 seconds

we executed an Nmap SYN scan using -D RND:5, so Nmap generated five random decoy IPs — 236.162.235.164, 155.55.153.66, 192.133.220.200, 224.154.98.193, and 191.61.26.184 — and included our actual scanner IP, 10.10.17.199, among them. Nmap sent six SYN packets toward target 10.129.2.80 on port 80, and the target responded with SYN/ACK to your actual IP 10.10.17.199, confirming that port 80 is open. In short: our real IP was mixed with five randomly generated decoy IPs to make the scan's origin harder to identify.

Scanning Options Description 10.129.2.28 Scans the specified target. -p 80 Scans only the specified ports. -sS Performs SYN scan on specified ports. -Pn Disables ICMP Echo requests. -n Disables DNS resolution. --disable-arp-ping Disables ARP ping. --packet-trace Shows all packets sent and received. -D RND:5 Generates five random IP addresses that indicates the source IP the connection comes from.

When we use Nmap decoy scanning (-D), some ISPs and routers may detect spoofed source IP addresses and drop those packets because they do not belong to the network from which they appear to originate. To handle this, we can specify known VPS IP addresses as decoys instead of relying on randomly generated IPs. For example,

if we have our Kali machine and three VPS servers with different public IPs, we can specify those IPs as decoys to make the scan appear to originate from multiple sources. The -S option serves a different purpose: it manually sets the source IP address in outgoing packets, allowing us to test how the target network handles traffic associated with different source addresses or subnets. We can also combine decoy techniques with SYN, ACK, ICMP and OS-detection scans to observe the target's responses and gather information about its operating system.

In simple terms: -D adds decoy source IPs to make scan attribution harder, while -S specifies the source IP address used in scan packets. Spoofing does not guarantee that packets will reach the target or that responses will return to our scanner.

Testing Firewall Rule

└─$ sudo nmap  10.129.2.80 -n -Pn -p445 -O
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-02 10:05 +0530
Nmap scan report for 10.129.2.80
Host is up (0.57s latency).
PORT    STATE SERVICE
445/tcp open  microsoft-ds
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.19, Linux 5.0 - 5.14
Network Distance: 2 hops
OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.54 seconds
┌──(kali㉿kali)-[~/Desktop]
└─$ sudo nmap -n -Pn -p1-1000 -O 10.129.2.80
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-02 10:07 +0530
Nmap scan report for 10.129.2.80
Host is up (0.64s latency).
Not shown: 994 closed tcp ports (reset)
PORT    STATE SERVICE
22/tcp  open  ssh
80/tcp  open  http
110/tcp open  pop3
139/tcp open  netbios-ssn
143/tcp open  imap
445/tcp open  microsoft-ds
Device type: general purpose
Running: Linux 5.X
OS CPE: cpe:/o:linux:linux_kernel:5
OS details: Linux 5.0 - 5.14
Network Distance: 2 hops
OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 10.19 seconds

Earlier, we scanned only port 445, which was open. This time, we scanned ports 1–1000 and discovered both open and closed ports. Nmap could use their TCP responses to improve OS fingerprinting.

Final takeaway: Our target is most likely running Linux kernel 5.x, with SMB (445), HTTP (80), SSH (22), POP3 (110) and IMAP (143) among its exposed services.

Scanning Options Description 10.129.2.28 Scans the specified target. -n Disables DNS resolution. -Pn Disables ICMP Echo requests. -p 445 Scans only the specified ports. -O Performs operation system detection scan. -S Scans the target by using different source IP address. 10.129.2.200 Specifies the source IP address. -e tun0 Sends all requests through the specified interface.

DNS Proxying

DNS Proxying means we can tell Nmap which DNS server to use for resolving target IP addresses into domain names using --dns-server.

Real-world example: Imagine a company has an internal DNS server that knows the names of its internal machines, but public DNS servers don't. If we are inside the company's DMZ, we can use its trusted DNS server to resolve internal hostnames.

Now lets' have a real example for this i setup own server with firewalls rules

We configured our firewall with two rules:

sudo iptables -I INPUT 1 -p tcp --dport 50000 --sport 53 -j ACCEPT
sudo iptables -I INPUT 2 -p tcp --dport 50000 -j DROP
  • Rule 1: Accept incoming TCP packets destined for port 50000 if their source port is 53.
  • Rule 2: Drop all other incoming TCP packets destined for port 50000.
┌──(kali㉿kali)-[~/Desktop]
└─$ sudo nmap -p50000 -sS -Pn -n --disable-arp-ping --packet-trace 127.0.0.1
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-02 10:18 +0530
SENT (0.0345s) TCP 127.0.0.1:63469 > 127.0.0.1:50000 S ttl=46 id=16424 iplen=44  seq=1837786738 win=1024 <mss 1460>
RCVD (0.0345s) TCP 127.0.0.1:63469 > 127.0.0.1:50000 S ttl=46 id=16424 iplen=44  seq=1837786738 win=1024 <mss 1460>
SENT (1.0358s) TCP 127.0.0.1:63471 > 127.0.0.1:50000 S ttl=51 id=59551 iplen=44  seq=1837655664 win=1024 <mss 1460>
RCVD (1.0358s) TCP 127.0.0.1:63471 > 127.0.0.1:50000 S ttl=51 id=59551 iplen=44  seq=1837655664 win=1024 <mss 1460>
Nmap scan report for 127.0.0.1
Host is up.
PORT      STATE    SERVICE
50000/tcp filtered ibm-db2
Nmap done: 1 IP address (1 host up) scanned in 2.07 seconds
┌──(kali㉿kali)-[~/Desktop]
└─$ sudo nmap -p50000 -sS -Pn -n --packet-trace --source-port 53 127.0.0.1
Starting Nmap 7.99 ( https://nmap.org ) at 2026-11-02 10:19 +0530
SENT (0.0308s) TCP 127.0.0.1:53 > 127.0.0.1:50000 S ttl=59 id=61317 iplen=44  seq=3217999399 win=1024 <mss 1460>
RCVD (0.0308s) TCP 127.0.0.1:53 > 127.0.0.1:50000 S ttl=59 id=61317 iplen=44  seq=3217999399 win=1024 <mss 1460>
RCVD (0.0308s) TCP 127.0.0.1:50000 > 127.0.0.1:53 SA ttl=64 id=0 iplen=44  seq=1916572402 win=65495 <mss 65495>
Nmap scan report for 127.0.0.1
Host is up (0.000063s latency).
PORT      STATE SERVICE
50000/tcp open  ibm-db2
Nmap done: 1 IP address (1 host up) scanned in 0.07 seconds
─$ ncat -nv --source-port 53 127.0.0.1 50000
Ncat: Version 7.991 ( https://nmap.org/ncat )
Ncat: Connected to 127.0.0.1:50000.

During the normal scan, Nmap used a random source port (63469). Our firewall dropped the packet, so Nmap received no response and reported the port as filtered.

During the second scan, we used --source-port 53. The firewall matched the source-port-based ACCEPT rule and allowed the packet. The target responded with SYN/ACK, so Nmap identified port 50000 as open.

Real-world Security Scenario

Imagine a company firewall that blindly trusts incoming packets originating from source port 53 because DNS commonly uses that port. An attacker could craft TCP packets with source port 53 to exploit this weak firewall configuration.

Key takeaway: The --source-port 53 option can help us test poorly configured firewall rules. However, using source port 53 does not automatically bypass firewalls; it only works when the firewall's rules permit that traffic.

Scanning Options Description 10.129.2.28 Scans the specified target. -p 50000 Scans only the specified ports. -sS Performs SYN scan on specified ports. -Pn Disables ICMP Echo requests. -n Disables DNS resolution. --disable-arp-ping Disables ARP ping. --packet-trace Shows all packets sent and received. --source-port 53 Performs the scans from specified source port

Firewall and IDS/IPS Evasion Labs

Pasted image 20261102103836.png

Firewall and IDS/IPS Evasion — Medium Lab

None None

Firewall and IDS/IPS Evasion — Hard Lab

sudo nmap -p50000 -sS -Pn -n --packet-trace --source-port 53 10.129.2.47
sudo ncat -nv --source-port 53 10.129.2.47 50000
None