Service, version and OS detection, and NSE

From "open" to "what exactly"

An open port tells you a door is unlocked. Version detection tells you what is behind it. The -sV flag makes nmap talk to each open port and work out the service and, often, its exact version. This is the single most useful upgrade to a basic scan.

nmap -sV 192.168.56.102        # detect service and version on open ports
nmap -sV -O 192.168.56.102     # also guess the operating system
nmap -A 192.168.56.102         # aggressive: -sV, -O, default scripts and traceroute

Reading version output

A -sV result line might read "80/tcp open http Apache httpd 2.4.49". That tells you the port, that it is open, the service (http) and the exact software and version (Apache 2.4.49). With the version in hand, a tester checks whether that version has known issues (the next module covers CVEs). A defender reads the same line as "we are advertising our exact version — let us hide that".

The Nmap Scripting Engine (NSE)

NSE lets nmap run small scripts for extra tasks: checking for a specific known issue, grabbing a banner, listing website directories, and more. Scripts are grouped into categories such as "default", "safe", "discovery" and "vuln".

nmap -sC 192.168.56.102                 # run the default script set
nmap --script safe 192.168.56.102       # run only scripts marked "safe"
nmap --script http-title 192.168.56.102 # run one named script

Detection and defence

Detection: version probes and scripts send extra, unusual requests that stand out in logs and to an IDS. Defence: hide or fake version banners, patch so a known version is not a liability, disable services you do not need, and watch for script-like traffic. Every version a server reveals is a hint; a good defender reveals as little as possible.