Scanning & Reconnaissance

Scanning is the process of discovering what services are running on a network target — which ports are open, what software is listening, and what operating system is in use. In NCL, you are given target IP addresses and must answer questions about the services running on them.

The primary tool is nmap (Network Mapper), a port scanner that probes TCP and UDP ports and identifies services by their responses.

1. TCP Port Scanning

A port is a numbered endpoint (0-65535) on a networked device. Each open port runs a service — port 22 runs SSH, port 80 runs HTTP, port 443 runs HTTPS. Scanning identifies which ports are open (accepting connections), closed (rejecting), or filtered (no response, likely firewalled).

Basic scans

# Scan the 1000 most common ports (default)
nmap 10.0.0.1

# Scan ALL 65535 ports (slower but complete)
nmap -p- 10.0.0.1

# Scan specific ports
nmap -p 22,80,443,8080 10.0.0.1

# Scan a range
nmap -p 1-1024 10.0.0.1

Scan types

In NCL, -sS (SYN scan) is the standard approach. It requires root/sudo but is faster and less likely to be logged.

2. Service and Version Detection

Knowing a port is open is step one. Knowing what software and version is running on it is step two — and is what NCL actually asks about.

# Detect service versions on open ports
nmap -sV 10.0.0.1

# Aggressive detection (version + OS + scripts + traceroute)
nmap -A 10.0.0.1

# Run default nmap scripts (vulnerability checks, banner grabbing)
nmap -sC 10.0.0.1

# Combined: stealth scan + version + scripts + OS detection
nmap -sS -sV -sC -O 10.0.0.1

The -sV flag probes open ports to determine the service name and version. For example, instead of just “port 80 open”, it reports “Apache httpd 2.4.41” — which you can then search for known vulnerabilities.

Banner grabbing

Some services send a banner (a text greeting) when you connect. You can grab banners manually:

# Connect to a port and read the banner
nc -v 10.0.0.1 22        # SSH banner
nc -v 10.0.0.1 21        # FTP banner
curl -I http://10.0.0.1  # HTTP server header

3. OS Detection

nmap can fingerprint the operating system by analyzing how the target responds to specific TCP/IP probes (window sizes, TTL values, TCP options):

# OS detection (requires root)
nmap -O 10.0.0.1

# Limit OS detection to promising targets
nmap -O --osscan-limit 10.0.0.1

OS detection is less reliable than service detection — it guesses based on TCP stack behavior. In NCL, it is occasionally asked but less common than service version questions.

4. Output and Scripting

Saving results

# Save in all formats (normal, XML, grepable)
nmap -oA scan_results 10.0.0.1

# Normal text output
nmap -oN results.txt 10.0.0.1

# Grepable output (one host per line, easy to parse)
nmap -oG results.gnmap 10.0.0.1

Parsing grepable output

# Find all hosts with port 80 open
grep "80/open" results.gnmap | awk '{print $2}'

# Find all open ports for a specific host
grep "10.0.0.1" results.gnmap

NSE (Nmap Scripting Engine)

nmap includes hundreds of scripts for vulnerability scanning, brute forcing, and information gathering:

# Run a specific script
nmap --script=http-title 10.0.0.1

# Run all scripts in a category
nmap --script=vuln 10.0.0.1

# List available scripts
ls /usr/share/nmap/scripts/ | grep http

5. Common Ports Reference

Memorize these — NCL frequently asks what service runs on a given port:

Resources

Practice: TryHackMe — Nmap (search “nmap”) · HackTheBox (real machines to scan)

Reference: Nmap Reference Guide · Port Number Database

Video: NetworkChuck — nmap tutorial · IppSec — HackTheBox enumeration