Nmap: fingerprinting and the scripting engine
Version and OS detection, NSE scripts.
Level 301 · 17 lessons · 18 practice labs
Lessons
Fingerprinting
- Identifying services with Nmap: You learn why knowing which service runs behind an open port matters for defence, and how to find out with Nmap on your own systems.
- Nmap version detection and intensity: You learn to use Nmap to detect service versions and list outdated software that needs updating on your own systems.
- Nmap OS fingerprinting: You will understand how Nmap guesses an operating system from its fingerprint and how to use that to verify the inventory of your own devices.
- The limits of fingerprinting: mismatches and confidence
- Short task: verify the version table of the lab targets
The scripting engine
- Nmap NSE scripts: finding them and categories: You will understand how to find scripts in nmap's scripting engine, NSE, and which categories suit safe auditing.
- Running default and safe scripts with Nmap: You learn to run Nmap scripts from the default and safe categories on your own lab systems and interpret their output.
- NSE script arguments and authenticated checks
- Script categories and their risks: what not to run in production
- The Nmap aggressive scan and reading its results: You learn what Nmap's all-in-one aggressive scan produces, how noisy it is on the network, and how to read its result.
- Short task: audit five services with safe scripts
Configuration audit and report
- Auditing your own systems for vulnerabilities with Nmap scripts: You learn to audit your own systems for known weaknesses with Nmap scripts, with permission, interpret the findings and decide what to close.
- Auditing TLS and SSH configuration with NSE
- SMB and HTTP configuration audit with NSE
- Producing a readable report from XML output
- Saving and reporting Nmap results: You learn to save Nmap scan results to files and turn them into a tidy findings report that managers can read.
- Capstone: report a service and configuration audit of a network with Nmap
Practice labs
- Validate the version table of the lab targets: Compare version detection results with the package data on the hosts and mark each table row as correct or wrong.
- Raise version detection intensity to identify an unclear service: Raise the intensity step by step for an unrecognised service, find the lowest setting that identifies it correctly and record why.
- Verify the real version of a service with an altered banner: Determine the real version of a service whose banner shows a different version on Turnalı Perakende's server using local evidence, and correct the inventory.
- Record the OS guesses for three targets: Run OS detection on three lab targets and write the guess and its confidence into the inventory columns.
- Firm up a low-confidence match with extra evidence: Provide an open and a closed port for the low-confidence target, repeat detection and explain why the result changed.
- Find and report end-of-life operating systems: Detect end-of-life operating systems in Saklıvadi Üniversitesi's lab network, confirm them and report them with upgrade priority.
- Find and choose scripts from the safe category: List the scripts in the safe and default categories and pick the suitable ones for five services.
- Audit five services with safe scripts: Audit the five services on the lab server with safe scripts only and write the configuration detail from each into a finding line.
- Prepare an allow-list of scripts fit for production: Write a script allow-list for Demirsu Enerji that excludes risky categories, try it in the lab and document the reason for each exclusion.
- List the web server's TLS cipher suites: List the protocols and ciphers the lab web server supports with the scripting engine and flag the weak ones.
- Audit and narrow the SSH server's algorithms: Extract the SSH server's key exchange and cipher algorithms with a script, remove the old ones from the configuration and audit again.
- Fix weak TLS settings and re-verify with scripts: Disable old protocols and weak ciphers on Lavinya Klinikleri's portal server and report a before-and-after table from script output.
- Audit the web server's headers and title: Extract the lab site's server header, page title and allowed methods with HTTP scripts and flag what is unnecessary.
- Audit SMB signing and protocol version: Check with scripts whether SMB signing is required and the old version is enabled on the file server, then apply the fix.
- Disable unnecessary HTTP methods and rescan: Find the risky HTTP methods left enabled on Kumsal Turizm's booking server, disable them in the server configuration and verify with a script.
- Turn XML output into a readable report: Convert the scripted scan XML to HTML with a stylesheet and mark which parts of the report suit a manager.
- Generate a findings table from script results: Parse the script outputs in the XML with a small script and produce a table with service, finding and recommendation columns.
- Report a network's service and configuration audit: Audit Ilgıntepe Tekstil's four-server lab network with scripts, rank the findings and write a report with closure verification.
About this course
Version and OS detection, NSE scripts.
What you will learn
- Fingerprinting
- The scripting engine
- Configuration audit and report
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.