CEH Day 3 Scanning

What is the primary purpose of scanning in ethical hacking?

To actively gather information about a target such as live hosts open ports services and versions

What is the difference between scanning and enumeration?

Scanning identifies hosts ports and services while enumeration gathers detailed information from identified services

What does Nmap stand for?

Network Mapper

What command performs a basic Nmap scan?

nmap <target_ip>

Which Nmap option performs service and version detection?

-sV

What does an open port mean?

A service is actively listening on that port

What does a closed port mean?

The host is reachable but no service is listening on that port

What does a filtered port mean?

Nmap cannot determine the port state because traffic may be blocked or filtered

Does an open port automatically mean the service is vulnerable?

No an open port only means a service is listening or accessible

Why is service version detection important?

It identifies the specific software and version for further enumeration and vulnerability assessment

What does ping help check?

Whether a target is reachable and responding to ICMP

Does a failed ping always mean the target is down?

No ICMP traffic may be blocked even when the host is active

Which service commonly runs on port 21?

FTP

Which service commonly runs on port 22?

SSH

Which service commonly runs on port 23?

Telnet

Which service commonly runs on port 25?

SMTP

Which service commonly runs on port 53?

DNS

Which service commonly runs on port 80?

HTTP

Which services are commonly associated with ports 139 and 445?

NetBIOS and SMB

Which service commonly runs on port 3306?

MySQL

Which service commonly runs on port 5432?

PostgreSQL

Complete the sequence Reconnaissance then Scanning then what then Vulnerability Assessment?

Enumeration

What comes after a port is discovered and a service is identified?

Enumeration

What additional information can nmap -sV provide?

Detailed service identification and version information

Why should scan results guide enumeration?

Because enumeration should focus on the specific services discovered during scannin

What does Host is up mean in an Nmap scan?

The target host is reachable and responded to the scan

What does latency in an Nmap result indicate?

The approximate time taken for communication between the scanner and target

What does Not shown closed tcp ports mean?

Those ports were scanned and found closed so Nmap did not list them individually

What are the three main columns in a basic Nmap port result?

PORT STATE and SERVICE

What information does the PORT column provide?

The port number and protocol being scanned

What information does the STATE column provide?

Whether the port is open closed filtered or another detected state

What information does the SERVICE column provide?

The service Nmap associates with the port

What additional information does version detection provide?

The software product and potentially its specific version running on a service

What is the difference between service detection and version detection?

Service detection identifies what service is running while version detection attempts to identify the specific software and version

Can a host be reachable while a specific port is closed?

Yes the host can be active even when no service is listening on that port

Can a host be reachable while a port is filtered?

Yes the host can be active while filtering prevents Nmap from determining the port state

What should you do after identifying open services during scanning?

Prioritize the discovered services for further enumeration

Why are different open ports investigated separately?

Each port may run a different service with different configurations and information exposure

What did the basic Nmap scan tell us about the Metasploitable target?

It identified multiple open ports and the services associated with them

What did nmap -sV add to our Metasploitable scan?

It identified specific service software and versions such as vsftpd OpenSSH and Apache

What is a practical scanning workflow?

Confirm reachability then scan ports identify services detect versions and use the results to guide enumeration