is a comma-separated list of script-files or script-updatedb: Update the script database. script-trace: Show all data sent and received script-args-file=filename: provide NSE script args in a file script-args=: provide arguments to scripts version-trace: Show detailed version scan activity (for debugging)ĭirectories, script-files or script-categories version-all: Try every single probe (intensity 9) version-light: Limit to most likely probes (intensity 2) version-intensity : Set from 0 (light) to 9 (try all probes) sV: Probe open ports to determine service/version info port-ratio : Scan ports more common than r: Scan ports consecutively - don't randomize F: Fast mode - Scan fewer ports than the default scan exclude-ports : Exclude the specified ports from scanning We can start by taking a look at the huge list of scanning options: Nmap, which we have already analyzed for Network Discovery in this topic, is the most famous tool for port scanning: by sending probes to the target it is able to find which ports are open and which services are running on them (this is just one of its capabilities). Remember to configure it so as its IP address is in the same LAN of the attacking machine (in my case the LAN is 192.168.1.0/24). If everything has been done correctly you should get this terminal prompt: Once the VM image is downloaded it is just a matter of extracting the files from the archive and import it in your Hypervisor: for example, in VMware Workstation Player click on “Open a Virtual Machine”, select the extracted Metasploitable 2 image and you are ready to launch it. be sure to run it in a local network environment behind a Router Firewall.

The virtual machine can be downloaded for free from here because of its nature, do not expose this VM on the Internet, i.e. This system, created by Metasploit team, has been build intentionally vulnerable to a series of attacks by exposing compromised services through open ports. Since we need a target against which we can launch our port scanning attacks, we need to create a very basic testing laboratory that includes our attacking machine, in my case Kali Linux, and a target machine: for this lab session I suggest to download a VM called Metasploitable 2.

This activity represents an important step in the active reconnaissance phase. This is the reason why if a port is open it is possible to eventually identify what kind of service uses it by sending specially crafted packets to the target. Port scanning is a technique used to identify if a port on the target host is open or closed a port can be open if there is a service that uses that specific port to communicate with other systems.

Zenmap port scanner