📡 Scanning & Enumeration
Mapping what's actually running — the tester's radar⏱ ~3 min
Once recon gives you the lay of the land, scanning maps the target's actual technical surface: which machines are alive, which network 'doors' (ports) are open, and which services are listening behind them. Enumeration then digs deeper into those services for specific details.
Ports and Services — The Doors of a Computer
A server is like an office building with thousands of numbered doors (ports). Each open door leads to a specific service: door 80 is the public web lobby (HTTP), door 443 is the secure lobby (HTTPS), door 22 is the staff entrance (SSH). Scanning is walking the perimeter noting which doors are open and what's behind each one.
| Port | Service | What It's For |
|---|---|---|
| 22 | SSH | Secure remote command-line access |
| 80 | HTTP | Unencrypted web traffic |
| 443 | HTTPS | Encrypted web traffic |
| 53 | DNS | Domain name lookups |
| 3389 | RDP | Windows Remote Desktop |
| 25 / 587 | SMTP | Sending email |
What Scanning Reveals
- •Live hosts — which IP addresses actually have a machine responding
- •Open ports — which network services are reachable
- •Service versions — e.g., 'Apache 2.4.52' — critical, because old versions have known vulnerabilities
- •Operating system — often guessable from how a system responds
Nmap — The Industry-Standard Scanner
Nmap ('Network Mapper') is the classic, free, open-source scanning tool. It's the first tool most testers reach for. Here's the *concept* of a basic scan (only ever run against systems you own or are authorized to test):
# Only run against systems you OWN or are AUTHORIZED to test. # Basic scan: what ports are open on this host?nmap 192.168.1.10 # Service/version detection: what's running, and what version?nmap -sV 192.168.1.10 # Scan your own machine to learn safely:nmap localhostIn scanning, what does an 'open port' represent?