Reconnaissance & Enumeration
Active Scanning with Nmap
Find open ports, services, and versions — the map you attack from.
Active scanning sends packets to the target to discover live hosts, open ports, and the services (and versions) behind them. Nmap is the industry-standard tool.
# Discover live hosts on a subnet
nmap -sn 192.168.56.0/24
# Fast scan of top ports
nmap -F 192.168.56.101
# Service + version detection on all ports (the workhorse)
nmap -sV -p- 192.168.56.101
# Run default scripts for extra detail
nmap -sC -sV 192.168.56.101Reading the output
Each open port with its service and version is a lead. 'Apache 2.4.49' or 'vsftpd 2.3.4' can be searched for known exploits. Version numbers are exactly what you feed into the next phase.