Networking Basics
Which protocol uses a three-way handshake, TCP or UDP?
TCP
What port does SSH use by default?
22
Which flag scans all 65,535 ports?
-p-
22/tcp open ssh: What port is open, and what does Nmap think is running on it?
Port 22, SSH
You just connected to a new network. What's your first step?
Host discovery: find what's alive, with arp-scan or nmap -sn.
What are the three steps of the TCP handshake, in order?
SYN, SYN-ACK, ACK
What service usually runs on port 445?
SMB
Which flag detects service versions?
-sV
23/tcp closed telnet: What did the target send back to Nmap's SYN?
A RST. The host is up, but nothing is listening on that port.
You found port 80 open. Name a tool from today that shows what's running on it.
curl -I (nc or nmap -sV also count)
How many usable host addresses are in 192.168.56.0/24?
254 (.1 through .254)
What service runs on port 53, and does it use TCP, UDP, or both?
DNS. It uses both, mostly UDP, with TCP for large responses and zone transfers.
What's the difference between -sS and -sT?
-sS sends a SYN, reads the reply, then sends a RST, and needs sudo. -sT completes the full handshake, doesn't need sudo, and is more likely to be logged.
161/udp open|filtered snmp: Why can't Nmap decide between open and filtered?
It got no reply. Either something is listening and stayed silent, or a firewall dropped the packet.
You connected to port 25 with nc and got a mail server banner. How do you check if the user "admin" exists?
Type VRFY admin
Why are UDP scans so much slower than TCP scans?
UDP usually doesn't reply. Nmap can't tell open from filtered, so it has to wait for timeouts and retry.
Nmap finds port 2222 open, and -sV says it's SSH. How is that possible if SSH is port 22?
A service can run on any port. 22 is just the default, and an admin can move it.
What does -A turn on?
-sV, -sC, -O and traceroute
21/tcp open ftp vsftpd 2.3.4, and under it: ftp-anon: Anonymous FTP login allowed. Which two flags produced this, and what would you try next?
-sV gave the version and -sC gave the anonymous login check. Next: log in as anonymous, and look up vsftpd 2.3.4 for known vulnerabilities.
Nmap says the host is down, but you know it's running a web server. Why, and what do you do?
It's probably blocking Nmap's ping probes, so Nmap thinks it's down. Use -Pn to skip the check and scan anyway.
Why can't you use arp-scan to find hosts on a different network across a router?
ARP only works on your local network. Its requests are broadcasts, and routers don't forward broadcasts.
Nmap shows port 21 open as "ftp", but when you connect with nc you get an SSH banner. What's going on, and which one is telling the truth?
SSH is running on port 21. The plain scan's SERVICE column is only a guess from the port number. The banner (or -sV) is the truth.
Why might -T5 find fewer open ports than -T4 on the same host?
Its timeouts are so short that slow replies get missed or packets get dropped, so open ports get marked as closed or filtered.
All 1000 scanned ports are filtered. Is the host down? What does this tell you, and what would you try?
Probably not down. A firewall is likely dropping everything. Try -p- for other ports, try -sU, and look for other ways in.
You have permission to scan a huge network with thousands of addresses. A full -p- -A scan on everything would take days. How do you plan it?
Find live hosts first with -sn. Run a quick top-ports scan on those, then -p- on the interesting hosts. Run -sV and -sC only on open ports, and save everything with -oA.