Lab 02: Performing Active Reconnaissance

Overview

This lab moved from public research to directly probing systems in an isolated lab network. I discovered hosts, fingerprinted operating systems, compared how scan types look on the wire, and ran vulnerability scans to find weaknesses worth investigating further.

Objectives

  • Discover live hosts and identify their operating systems

  • Compare scan types through their packet sequences

  • Build custom scan profiles

  • Run vulnerability scans and interpret the results

Tools and Technologies

  • Nmap and Zenmap (host discovery, port scanning, OS detection)

  • Nmap Scripting Engine (ssh-hostkey)

  • Wireshark (packet analysis)

  • Nessus Essentials (vulnerability scanning)

  • OpenVAS / Greenbone Security Manager (vulnerability scanning)

  • Kali Linux and Windows attack machines

Lab Writeup

Host Discovery and OS Fingerprinting

Zenmap’s ping and Quick scan plus profiles identified the hosts below and mapped them on a network topology view.

IP Address

Operating System Identified

172.30.0.20

Microsoft Windows (version unknown)

172.30.0.30

Microsoft Windows Server 2012

172.30.0.40

Microsoft Windows Server 2016

172.31.0.40

Linux 2.6.32

172.31.0.50

Linux 3.11-4.1

172.31.0.60

Linux 2.6.15-2.6.26

Scan Traffic Analysis

  • SYN scan: captured the 3-packet sequence (SYN, SYN/ACK, RST), which resets the connection before the handshake completes

  • TCP Connect scan: captured the 4-packet sequence (SYN, SYN/ACK, ACK, RST), which completes the handshake before closing

  • UDP scan: scanned port 53 on 172.30.0.1 and captured the ICMP Destination Unreachable responses

  • ACK scan: reported all 100 scanned ports on 172.30.0.20 as filtered with no response

Targeted Nmap Scans

  • Used the ssh-hostkey script to retrieve the DSA and RSA host keys from 172.31.0.60

  • Created a custom Zenmap profile (nmap -p "22, 80, 443" -n -PS), which showed ports 22 and 80 open and port 443 closed on 172.31.0.60

Vulnerability Scanning

  • Created a Nessus policy and scan that flagged MS17-010, a high-severity SMBv1 remote code execution vulnerability linked to ETERNALBLUE and WannaCry

  • Ran an OpenVAS scan that detected a weak MySQL / MariaDB password, with changing the password as the recommended mitigation

  • Saw OpenVAS also report a high-severity vsftpd backdoor and anonymous FTP login on 172.31.0.40

Key Findings

  • Scan types leave different traffic patterns, which affects how visible they are to defenders

  • Filtered ports can hide services from some scan types, so a single scan doesn’t give the full picture

  • OS fingerprinting gives useful leads, but results may be imprecise or return a range of versions

  • Older systems can still carry critical, well-known vulnerabilities

  • Simple configuration problems like weak passwords can be as serious as missing patches

Key Skills Learned

  • Running and customizing Nmap and Zenmap scans

  • Reading TCP and UDP scan behavior in Wireshark

  • Using Nmap scripts to gather service details

  • Configuring and running Nessus and OpenVAS scans

  • Reading vulnerability reports, including severity and remediation guidance

Topics Covered

  • Active reconnaissance and network enumeration

  • Host discovery and port scanning

  • OS fingerprinting

  • TCP handshake and UDP behavior

  • Vulnerability assessment

Conclusion

This lab showed how to turn a list of IP addresses into a prioritized view of potential weaknesses. Seeing each scan in Wireshark also made it clear what these tools actually send across the network and what a defender would be able to see.

Lab File