Preparing your workspace...
Loading latest data


Scanning is the process of identifying active systems, open ports, running services, and available network resources on a target machine or network. It is one of the earliest stages of a penetration test or security assessment.
During scanning, a security tester determines:
Scanning helps security professionals understand the attack surface of a target system.
Scanning helps in:
Attackers use scanning to locate entry points, while defenders use it to identify weaknesses before attackers do.


Port scanning identifies open, closed, and filtered ports on a target machine.
Examples:
Identifies active hosts and devices connected to a network.
Detects services running behind open ports.
Examples:
Identifies known weaknesses in systems or applications.
During scanning, ports may appear in different states:
| State | Meaning |
| Open | Service is accepting connections |
| Closed | Port is reachable but unused |
| Filtered | Firewall or filtering prevents access |
Understanding port states is critical during reconnaissance.
TCP scanning is more reliable and commonly used. Most enterprise services use TCP.
Examples:
UDP scanning is slower and less reliable but important for identifying services such as:
The scanner directly interacts with the target system.
Examples:
Information is gathered without directly communicating with the target.
Examples:
OS fingerprinting attempts to identify the operating system running on a target.
Common operating systems detected during scanning:
Banner grabbing is the process of collecting information exposed by a service.
Examples:
This information helps security testers understand service versions and configurations.
Reconnaissance is the foundation of penetration testing.
Without proper scanning and information gathering:
Good reconnaissance increases assessment accuracy.
Does scanning help identify open ports?
Which protocol is commonly used by HTTPS?
What port state indicates firewall filtering?
Is UDP scanning generally slower than TCP scanning?
Which scanning type identifies active devices on a network?
True or False: Banner grabbing reveals service information.
Which port state accepts connections?
A tester wants to identify the operating system of a server. Which technique should be used?
True or False: Passive scanning directly communicates with the target system.
Which scanning category focuses on detecting services behind ports?
An administrator wants to identify exposed services in an organization. Which process should be performed first?
Which protocol is commonly associated with DNS queries?
True or False: Closed ports are unreachable.
What is the first major phase of reconnaissance?
A security analyst wants to discover listening services on a host. Which activity should be performed?
Practical scanning involves using specialized tools to discover hosts, open ports, running services, and operating systems on a network.
The most commonly used scanning tool is Nmap.
Nmap is a powerful open-source network scanning tool widely used by:
Nmap can:
Used to identify whether a host is online.
ping <IP> Scans common ports on a target system.
nmap <IP> 
Performs a stealthier TCP scan by sending SYN packets without completing the full TCP handshake.
nmap -sS <IP> Detects running services and their versions on open ports.
nmap -sV <IP> Aggressive scanning performs multiple detection techniques together.
nmap -A <IP> 
Used to identify UDP services such as DNS, SNMP, and NTP.
nmap -sU <IP> Scans all TCP ports on the target machine.
nmap -p- <IP> Nmap scan results can be exported and stored for analysis.
nmap -oN result.txt <IP> Timing templates control scan speed and performance.
nmap -T4 <IP> nmap -T5 <IP> Higher timing values increase scanning speed.
Netcat can manually connect to services and capture banners.
nc <IP> 25 Telnet can interact directly with TCP services for testing and enumeration.
telnet <IP> 110 Following a structured workflow improves scanning efficiency and reduces missed information.
Which tool is most commonly used for network scanning?
Which Nmap option performs service detection ?
True or False: The -A option enables aggressive scanning.
A tester wants to scan all TCP ports on a server. Which option should be used?
Which command is used for UDP scanning ?
Which tool can manually connect to a TCP service for banner grabbing ?
True or False: Telnet can interact with remote services.
Which Nmap scan type is considered stealthier ?
Which option is used to save Nmap scan results ?
A security analyst wants to identify the operating system of a target. Which command is commonly used ?
Which protocol does ping primarily use ?
True or False: Timing templates control scan speed.
Which command identifies service versions running on a host ?
A penetration tester wants faster scans during an internal assessment.
Which timing option is commonly used?
Which utility is commonly used for banner grabbing over SMTP ?