Active Reconnaissance and Network Scanning with Nmap
Scan ports and services with Nmap: version detection, OS fingerprinting, share enumeration, and how to read the results correctly.
4 hrs/week
🟩 Reconnaissance · Cycle: 2. Reconnaissance (active) HTB Academy: Network Enumeration with Nmap, Footprinting
Objectives
- Map a target using active tools.
- Understand port scanning, service/OS detection, and enumeration.
Active reconnaissance: what is it?
Unlike passive OSINT (S3), active reconnaissance involves sending packets directly to the target to probe it: which ports are open? Which services are running? Which versions? Which operating system? It is far more accurate, but the target can detect it (in its logs, through an IDS/firewall). That is why it is essential to be authorized (an active scan "touches" the target and, depending on the law, can be treated as an intrusion attempt).
Lecture (1 h 20)
- Passive vs. active (and legal implications: active scanning "touches" the target).
- Scan types: SYN (
-sS), TCP connect (-sT), UDP (-sU), version (-sV), OS (-O). - Noise, stealth, timing (
-T0..-T5).