Table of Contents

1. Introduction to Network Scanning ..................................... ............................ 3

2. Lab Objectives ........................................................................ ........................ 3
3. Key Concepts Covered .......................................................... .......................... 4
3.1 Network Scanning ................................................................................. 4
3.2 Port Scanning ........................................................................................ 4
3.3 TCP vs UDP Scanning ............................................................................. 4
3.4 Banner Grabbing ................................................................................... 4
3.5 OS Fingerprinting .................................................................................. 4
4. Importance of the Scanning Phase ................................... .............................. 4
5. Professional Reflection ...................................................... ............................. 5
Lab 01: Perform Host Discovery .................................................................... 6
Overview of Host Discovery .................................................. .......................... 6
Task 1: Perform Host Discovery using Nmap .................................................. 6
ARP, UDP, ICMP, TCP & IP Ping Techniques .............................................. 7-10
Lab 02: Perform Port and Service Discovery ................................................ 11
Overview of Port and Service Discovery ...................... ................................. 11
Task 1: Explore Network Scanning Techniques ............................................ 13
TCP Connect Scan (-sT) ................................................................................ 14
Stealth Scan (-sS) ......................................................................................... 15
Xmas Scan (-sX) ...................................................................... ....................... 16
Maimon Scan (-sM) ..................................................................................... 17
ACK Scan (-sA) ....................................................................... .................. 18–19
Lab 03: Perform OS Discovery ..................................................................... 20
Overview of OS Discovery / Banner Grabbing .............................................. 20
TTL & TCP Window Size Table ...................................................................... 21
OS Discovery using Nmap (-A, -O) .......................................................... 22–23
SMB OS Discovery Analysis .................................................................... 24–25
Lab 04: Scan Beyond IDS and Firewall ......................................................... 26
Overview of IDS/Firewall Evasion ................................................................ 26
Evasion Techniques ..................................................................................... 27

1|Page
 Packet Fragmentation (-f) ...................................................... ....................... 28
Source Port Manipulation (-g) ..................................................................... 29
MTU Manipulation (--mtu) .......................................................................... 30
Decoy Scan (-D) .................................................................... ......................... 31
MAC Address Spoofing (--spoof-mac) .................................................... 32–33
Lab 05: Perform Network Scanning using Various Tools .............................. 34
Overview of Network Scanning Tools ................................ ........................... 34
Task 1: Scan Target Network using Metasploit ............................................ 35
Subnet Scan via Nmap in Metasploit ............................. ............................... 36
SYN Port Scan Module ........................................................................... 37–38
TCP Port Scan Module ................................................................................. 39
SMB Version Detection Module .................................................................. 40
Final Results & Enumeration ....................................................................... 40
Conclusion …………………………………………………………………………………………………41
References …………………………………………………………………………………………………42

2|Page
1. Introduction to Network Scanning
Network scanning is a systematic process used to identify live hosts, open
ports, running services, operating systems, and potential vulnerabilities within
a target network.
In ethical hacking, scanning is not actual intrusion — it is an advanced
reconnaissance phase. It helps penetration testers gather detailed technical
insights about a target system before attempting exploitation.
During scanning, an ethical hacker aims to:
• Identify live systems (active hosts)
• Discover open TCP/UDP ports
• Detect services running on those ports
• Perform OS fingerprinting
• Identify possible misconfigurations and vulnerabilities
This phase is critical because it provides a technical attack surface overview,
helping security professionals understand how a system could potentially be
compromised.

2. Lab Objectives
The objective of this lab was to:
• Conduct network scanning
• Perform port scanning
• Analyze discovered hosts and services
• Identify network vulnerabilities
Specifically, network scans were performed to:
• Check live systems and open ports
• Identify services running on live systems
• Perform banner grabbing and OS fingerprinting
• Detect potential network vulnerabilities

3|Page
3. Key Concepts Covered
a) Network Scanning
Used to discover active devices within a network range and map the network
structure.
b) Port Scanning
Involves connecting to TCP and UDP ports to determine:
• Which ports are open
• What services are running
• Whether those services are vulnerable
c) TCP vs UDP Scanning
• TCP scanning identifies services on connection-oriented communication.
• UDP scanning identifies services using connectionless communication
(often harder to detect).
d) Banner Grabbing
Used to extract service version information from open ports, helping identify
outdated or vulnerable services.
e) OS Fingerprinting
Determines the operating system running on a target machine by analyzing
network responses.

4. Importance of the Scanning Phase

Scanning is one of the most critical stages of intelligence gathering. It enables
the tester to:
• Build a technical profile of the target organization
• Identify externally accessible systems
• Map exposed services
• Discover misconfigurations
• Prioritize vulnerabilities for exploitation
Without proper scanning, exploitation becomes blind and inefficient.

4|Page
5. Professional Reflection
This lab strengthened my understanding of how attackers map and analyze a
target network before launching an attack. It also reinforced the importance
of:
• Minimizing exposed services
• Hardening unnecessary open ports
• Keeping services updated
• Implementing proper monitoring and detection
Understanding scanning from an attacker’s perspective helps in building
stronger defensive strategies.

5|Page
 Lab 01: Perform Host Discovery
Host discovery is the process of identifying active hosts in the target network.

Overview of Host Discovery

Host discovery is considered the primary task in the network scanning process.
It is used to discover the active/live hosts in a network. It provides an accurate
status of the systems in the network, which, in turn, reduces the time spent on
scanning every port on every system in a sea of IP addresses in order to
identify whether the target host is up.
The following are examples of host discovery techniques:
• ARP ping scan
• UDP ping scan
• ICMP ping scan (ICMP ECHO ping, ICMP timestamp, ping ICMP, and
address mask ping)
• TCP ping scan (TCP SYN ping and TCP ACK ping)
• IP protocol ping scan

Task 01: Perform Host Discovery using Nmap

Nmap is a utility used for network discovery, network administration, and
security auditing. It is also used to perform tasks such as network inventory,
managing service upgrade schedules, and monitoring host or service uptime.
Here, we will use Nmap to discover a list of live hosts in the target network.
We can use Nmap to scan the active hosts in the target network using various
host discovery techniques such as ARP ping scan, UDP ping scan, ICMP ECHO
ping sweep, etc.
• Turn on Windows 10 ([Link]), Parrot OS ([Link]) and
Kali Linux ([Link]) virtual machines.
• Switch to the Kali Linux virtual machine and login with your credentials.
• Open a Terminal window and execute sudo su to run the programs as a
root user.
Note: The password that you type will not be visible.

6|Page
 • Run nmap -sn -PR <Target IP Address> command (here, the target IP
address is [Link]).
Note: -sn disables port scan and -PR performs ARP ping scan.
• The scan results appear, indicating that the target Host is up, as shown
in the screenshot.
Note: In this lab, we are targeting the Windows VM ([Link]).
ARP Ping Scan Note
• The ARP ping scan sends an ARP request to the target host.
• If an ARP response is received, it means the host is active.

• Run nmap -sn -PU <Target IP Address> command (here, the target IP
address is same as the previous one). The scan results appear, indicating
that the target Host is up, as shown in the screenshot.
Note: -PU performs the UDP ping scan.
Note: The UDP ping scan sends UDP packets to the target host; a UDP
response means that the host is active. If the target host is offline or
unreachable, various error messages such as “host/network unreachable” or
“TTL exceeded” could be returned.

7|Page
 • Now, we will perform the ICMP ECHO ping scan. Run nmap -sn -PE
<Target IP Address> command (here, the target IP address is same as
the previous one). The scan results appear, indicating that the target
Host is up, as shown in the screenshot.
Note: -PE performs the ICMP ECHO ping scan.
Note: The ICMP ECHO ping scan involves sending ICMP ECHO requests to a
host. If the target host is alive, it will return an ICMP ECHO reply. This scan is
useful for locating active devices or determining if ICMP is passing through a
firewall.

• Now, we will perform an ICMP ECHO ping sweep to discover live hosts
from a range of target IP addresses. Run nmap -sn -PE <Target Range of
IP Addresses> command (here, we have specified only 2 IPs i.e. one of
Windows VM and other of Parrot VM). The scan results appear,
indicating that the target Host is up, for both the targets that we have
scanned, as shown in the screenshot.

8|Page
Note: The ICMP ECHO ping sweep is used to determine the live hosts from a
range of IP addresses by sending ICMP ECHO requests to multiple hosts. If a
host is alive, it will return an ICMP ECHO reply.

• Run nmap -sn -PP <Target IP Address> command, (here, the target IP
address is also the same that we have used for Windows VM). The scan
results appear, indicating the target Host is up, as shown in the
screenshot.
Note: -PP performs the ICMP timestamp ping scan.
Note: ICMP timestamp ping is an optional and additional type of ICMP ping
whereby the attackers query a timestamp message to acquire the information
related to the current time from the target host machine.

• Apart from the aforementioned network scanning techniques, you can

also use the following scanning techniques to perform a host discovery
on a target network.

9|Page
 ❖ ICMP Address Mask Ping Scan: This technique is an alternative
for the traditional ICMP ECHO ping scan, which are used to
determine whether the target host is live specifically when
administrators block the ICMP ECHO pings.
# nmap -sn -PM <target IP address>
❖ TCP SYN Ping Scan: This technique sends empty TCP SYN packets
to the target host, ACK response means that the host is active.
# nmap -sn -PS <target IP address>
❖ TCP ACK Ping Scan: This technique sends empty TCP ACK packets
to the target host; an RST response means that the host is active.
# nmap -sn -PA <target IP address>
❖ IP Protocol Ping Scan: This technique sends different probe
packets of different IP protocols to the target host, any response
from any probe indicates that a host is active.
# nmap -sn -PO <target IP address>

• This concludes the demonstration of discovering the target host(s) in the

target network using various host discovery techniques.
• Close all open windows and document all the acquired information.

10 | P a g e
 Lab 02: Perform Port and Service Discovery
Port and service discovery is the process of identifying open ports and services
running on the target IP addresses/active hosts.

Overview of Port and Service Discovery

Port scanning techniques are categorized according to the type of protocol
used for communication within the network.
• TCP Scanning
o Open TCP scanning methods (TCP connect/full open scan)
o Stealth TCP scanning methods (Half-open scan, Inverse TCP Flag
scan, ACK flag probe scan, third party and spoofed TCP scanning
methods)
• UDP Scanning
• SCTP Scanning
o SCTP INIT Scan
o SCTP COOKIE/ECHO Scanning
• SSDP and List Scanning
• IPv6 Scanning

Task 01: Explore Various Network Scanning Techniques using Nmap

Nmap comes with various inbuilt scripts that can be employed during a
scanning process in an attempt to find the open ports and services running on
the ports. It sends specially crafted packets to the target host, and then
analyzes the responses to accomplish its goal. Nmap includes many port
scanning mechanisms (TCP and UDP), OS detection, version detection, ping
sweeps, etc.
Here, we will use Nmap to discover open ports and services running on the live
hosts in the target network.
• Turn on the Windows 10 and Kali Linux virtual machines.
• Switch to the Kali Linux VM, and login. Click on the Tool Menu in the top
left, search for zenmap in the search field and open the app.

11 | P a g e
 • The Zenmap appears; in the Command field, type nmap -sT -v <Target IP
Address> (here, the target IP address is [Link]) and click Scan.
Note: -sT performs the TCP connect/full open scan and -v enables the verbose
output (include all hosts and ports in the output).
• The scan results appear, displaying all the open TCP ports and services
running on the target machine, as shown in the screenshot.
Note: TCP connect scan completes a three-way handshake with the target
machine. In the TCP three-way handshake, the client sends a SYN packet,
which the recipient acknowledges with the SYN+ACK packet. In turn, the client
acknowledges the SYN+ACK packet with an ACK packet to complete the
connection. Once the handshake is completed, the client sends an RST packet
to end the connection.

• Click the Ports/Hosts tab to gather more information on the scan results.
Nmap displays the Port, Protocol, State, Service, and Version of the scan.

12 | P a g e
• Click the Topology tab to view the topology of the target network that
contains the provided IP address and click the Fisheye option to view the
topology clearly.

13 | P a g e
 • In the same way, click the Host Details tab to view the details of the TCP
connect scan.

• Click the Services tab located in the left pane of the window. This tab
displays a list of services.

Note: You can use any of these services and their open ports to enter into the
target network/host and establish a connection.

14 | P a g e
• In this sub-task, we shall be performing a stealth scan/TCP half-open
scan, Xmas scan, TCP Maimon scan, and ACK flag probe scan on a
firewall-enabled machine (i.e., Windows VM: [Link]) in order
to observe the result. To do this, we need to enable Windows Firewall in
the Windows virtual machine.
• Switch to the Windows Virtual machine and login with your credentials.
• Navigate to Control Panel → System and Security → Windows Defender
Firewall → Turn Windows Defender Firewall on or off, enable Windows
Firewall and click OK.
• Now, switch to the Kali Linux virtual machine. Launch Zenmap, type
nmap -sS -v <Target IP Address> (here, the target IP address is
[Link]) and click Scan.
Note: -sS performs the stealth scan/TCP half-open scan and -v enables the
verbose output (include all hosts and ports in the output).
• The scan results appear, displaying all open TCP ports and services
running on the target machine, as shown in the screenshot.
Note: The stealth scan involves resetting the TCP connection between the
client and server abruptly before completion of three-way handshake
signals, and hence leaving the connection half-open. This scanning
technique can be used to bypass firewall rules, logging mechanisms, and
hide under network traffic.

15 | P a g e
 • As shown in the last task, you can gather detailed information from the
scan result in the Ports/Hosts, Topology, Host Details, and Scan tab.
• Similarly, type nmap -sX -v <Target IP Address> (here, the target IP
address is [Link]) and click Scan.
Note: -sX performs the Xmas scan and -v enables the verbose output (include
all hosts and ports in the output).
• The scan results appear, displaying that the ports are either open or
filtered on the target machine, which means a firewall has been
configured on the target machine.
Note: Xmas scan sends a TCP frame to a target system with FIN, URG, and
PUSH flags set. If the target has opened the port, then you will receive no
response from the target system. If the target has closed the port, then you
will receive a target system reply with RST.

16 | P a g e
 • In the Command field, type nmap -sM -v <Target IP Address> (here, the
target IP address is [Link]) and click Scan.
Note: -sM performs the TCP Maimon scan and -v enables the verbose output
(include all hosts and ports in the output).
• The scan results appear, displaying either the ports are open/filtered on
the target machine, which means a firewall has been configured on the
target machine.
Note: In the TCP Maimon scan, a FIN/ACK probe is sent to the target; if there is
no response, then the port is Open|Filtered, but if the RST packet is sent as a
response, then the port is closed.

17 | P a g e
 • In the Command field, type nmap -sA -v <Target IP Address> (here, the
target IP address is [Link]) and click Scan.
Note: -sA performs the ACK flag probe scan and -v enables the verbose output
(include all hosts and ports in the output).
• The scan results appear, displaying that the ports are filtered on the
target machine, as shown in the screenshot.
Note: The ACK flag probe scan sends an ACK probe packet with a random
sequence number; no response implies that the port is filtered (stateful
firewall is present), and an RST response means that the port is not filtered.

18 | P a g e
• This concludes the demonstration of discovering target open ports,
services, service versions, device type, OS details, etc. of the active hosts
in the target network using various scanning techniques of Nmap.
• Close all open windows and document all the acquired information.

19 | P a g e
 Lab 03: Perform OS Discovery
Banner grabbing, or OS fingerprinting, is used to determine the OS running on
a remote target system.

Overview of OS Discovery/Banner Grabbing

Banner grabbing, or OS fingerprinting, is a method used to determine the OS
that is running on a remote target system.
There are two types of OS discovery or banner grabbing techniques:
a) Active Banner Grabbing
Specially crafted packets are sent to the remote OS, and the responses are
noted, which are then compared with a database to determine the OS.
Responses from different OSes vary, because of differences in the TCP/IP
stack implementations.
b) Passive Banner Grabbing
This depends on the differential implementation of the stack and the
various ways an OS responds to packets. Passive banner grabbing includes
banner grabbing from error messages, sniffing the network traffic, and
banner grabbing from page extensions.
Parameters such as TTL and TCP window size in the IP header of the first
packet sent in a TCP session play an important role in identifying the OS
running on the target machine. The TTL field determines the maximum time a
packet can remain in a network, and the TCP window size determines the
length of the packet reported. These values differ for different OSes. You can
refer to the following table to learn the TTL values and TCP window size
associated with various OSes.

20 | P a g e
Operating System Time To Live (TTL) TCP Window Size

Linux 64 5840

FreeBSD 64 65535

OpenBSD 255 16384

65,535 bytes to 1
Windows 128
Gigabyte

Cisco Routers 255 4128

Solaris 255 8760

AIX 255 16384

Task 01: Perform OS Discovery using Nmap Script Engine (NSE)

Nmap, along with Nmap Script Engine (NSE), can extract considerable valuable
information from the target system. In addition to Nmap commands, NSE
provides scripts that reveal all sorts of useful information from the target
system. Using NSE, you may obtain information such as OS, computer name,
domain name, forest name, NetBIOS computer name, NetBIOS domain name,
workgroup, system time of a target system, etc.
Here, we will use Nmap to perform OS discovery using -A parameter, -O
parameter, and NSE.
• Turn on Windows virtual machine and login with your credentials.
• Turn on the Kali Linux machine and login as a root user.
• In the terminal window, run nmap -A <Target IP Address> command
(here, the target machine is Windows VM ([Link])). The scan
results appear, displaying the open ports and running services along
with their versions and target details such as OS, computer name,
NetBIOS computer name, etc. under the Host script results section.
Note: -A performs an aggressive scan.
Note: The scan takes approximately 10 minutes to complete.

21 | P a g e
 • In the terminal window, run nmap -O <Target IP Address> command
(here, the target machine is Windows VM [[Link]]). The scan
results appear, displaying information about open ports, respective
services running on the open ports, and the name of the OS running on
the target system.
Note: -O performs the OS discovery.

22 | P a g e
Analysis of SMB OS Discovery and Full Port Scan:
• Executed nmap --script [Link] [Link]
• Host was detected as up and reachable.
• 999 TCP ports were reported as filtered (no-response).
• Only port 135 (MSRPC) was open.
• No OS details were displayed because SMB ports (445 and 139) were
blocked by the firewall.
• Since SMB service was not accessible, the script could not extract OS
information.
• Performed a full TCP SYN scan using nmap -sS -p- [Link]
• 65,533 TCP ports were filtered and only two ports were open:
o 135/tcp – MSRPC
o 7680/tcp – pando-pub (Windows Delivery Optimization)
• The large number of filtered ports indicates that a firewall is enabled,
reducing the attack surface.

23 | P a g e
 Lab 04: Scan Beyond IDS and Firewall
Scanning beyond IDS and firewall is a process of sending intended packets to
the target system in order to exploit IDS/firewall limitations.

Overview of Scanning beyond IDS and Firewall

An Intrusion Detection System (IDS) and firewall are security mechanisms
intended to prevent an unauthorized person from accessing a network.
However, even IDS and firewalls have some security limitations. Firewalls and
IDS intend to avoid malicious traffic (packets) from entering into a network,
but certain techniques can be used to send intended packets to the target and
evade IDS/firewalls.

Techniques to evade IDS/firewall:

• Packet Fragmentation: Send fragmented probe packets to the intended
target, which reassembles it after receiving all the fragments.
• Source Routing: Specifies the routing path for the malformed packet to
reach the intended target.
• Source Port Manipulation: Manipulate the actual source port with the
common source port to evade IDS/firewall.
• IP Address Decoy: Generate or manually specify IP addresses of the
decoys so that IDS/firewall cannot determine the actual IP address.
• IP Address Spoofing: Change source IP addresses so that the attack
appears to be coming in as someone else.
• Creating Custom Packets: Send custom packets to scan the intended
target beyond the firewalls.
• Randomizing Host Order: Scan the number of hosts in the target
network in a random order to scan the intended target that is lying
beyond the firewall.
• Sending Bad Checksums: Send the packets with bad or bogus TCP/UDP
checksums to the intended target.
• Proxy Servers: Use a chain of proxy servers to hide the actual source of a
scan and evade certain IDS/firewall restrictions.

24 | P a g e
 • Anonymizers: Use anonymizers that allow them to bypass Internet
censors and evade IDS/firewalls.

Task 01: Scan beyond IDS/Firewall using Various Evasion

Techniques
Nmap offers many features to help understand complex networks with
enabled security mechanisms and supports mechanisms for bypassing poorly
implemented defenses. Using Nmap, various techniques can be implemented,
which can bypass the IDS/firewall security mechanisms.
Here, we will use Nmap to evade IDS/firewall using various techniques such as
packet fragmentation, source port manipulation, MTU, and IP address
decoys.
• Turn on the Windows 10 and Kali Linux virtual machines.
• Switch to the Windows 10 virtual machine and login to it.
• Navigate to Control Panel → System and Security → Windows Defender
Firewall → Turn Windows Defender Firewall on or off, enable Windows
Defender Firewall and click OK, as shown in the screenshot.

25 | P a g e
 • Minimize the Control Panel window, click Windows Search icon on the
Desktop. Search for wireshark in the search field and click Open to
launch it.
• The Wireshark Network Analyzer window appears, start capturing
packets by double-clicking the available ethernet or interface.
• Switch to the Kali Linux machine and login to it.
• Open a Terminal window and execute sudo su to run the programs as a
root user.
• In the terminal window, run nmap -f <Target IP Address> command
(here, the target machine is Windows 10 [[Link]]).
Note: -f switch is used to split the IP packet into tiny fragment packets.
Note: Packet fragmentation refers to the splitting of a probe packet into
several smaller packets (fragments) while sending it to a network. When these
packets reach a host, IDS and firewalls behind the host generally queue all of
them and process them one by one. However, since this method of processing
involves greater CPU consumption as well as network resources, the
configuration of most IDSs makes it skip fragmented packets during port scans.
• Although Windows Defender Firewall is turned on in the target system
(here, Windows 10), you can still obtain the results displaying all open
TCP ports along with the name of the service running on the target
machine, as shown in the screenshot.

26 | P a g e
 • Switch to the Windows 10 machine (target machine). You can observe
the fragmented packets captured by the Wireshark, as shown in the
screenshot.

• Switch to the Kali Linux virtual machine.

• In the Kali Linux window, run nmap -g 80 <Target IP Address> command
(here, target IP address is [Link]).
Note: In this command, you can use the -g or --source-port option to perform
source port manipulation.
Note: Source port manipulation refers to manipulating actual port numbers
with common port numbers to evade IDS/firewall; this is useful when the
firewall is configured to allow packets from well-known ports like HTTP, DNS,
FTP, etc.
• The results appear, displaying all open TCP ports along with the name of
services running on the ports, as shown in the screenshot.

27 | P a g e
• Switch to the Windows 10 machine (target machine). In the Wireshark
window, scroll down and you can observe the TCP packets indicating
that the port number 80 is used to scan other ports of the target host, as
shown in the screenshot.

28 | P a g e
 • Switch to the Kali Linux virtual machine.
• Now, run nmap --mtu 8 <Target IP Address> command (here, target IP
address is [Link]).
Note: In this command, --mtu specifies the number of Maximum
Transmission Units (MTU) (here, 8 bytes of packets).
Note: Using MTU, smaller packets are transmitted instead of sending one
complete packet at a time. This technique evades the filtering and detection
mechanism enabled in the target machine.

29 | P a g e
 • Switch to the Windows 10 machine (target machine). In the Wireshark
window, scroll down and you can observe the fragmented packets
having maximum length as 8 bytes, as shown in the screenshot.

• Switch to the Kali Linux virtual machine.

• Now, run nmap -D RND:10 <Target IP Address> command (here, target
IP address is [Link]).
Note: In this command, -D performs a decoy scan and RND: generates a
random and non-reserved IP addresses (here, 10).
Note: The IP address decoy technique refers to generating or manually
specifying IP addresses of the decoys so that the IDS/firewall cannot determine
the network from which IDS/firewall to determine the actual IP address. By
using this command, Nmap automatically generates a random number of
decoys for the scan and randomly positions the real IP address between the
decoy IP addresses.

30 | P a g e
• Now, switch to the Windows 10 machine (target machine). In the
Wireshark window, scroll-down and you can observe the packets
displaying the multiple IP addresses in the source section, as shown in
the screenshot.

31 | P a g e
 • Switch to the Kali Linux virtual machine.
• In the terminal window, run nmap -sT -Pn --spoof-mac 0 <Target IP
Address> command (here, target IP address is [Link]).
Note: In this command, --spoof-mac 0 represents randomizing the MAC
address, -sT performs the TCP connect/full open scan, and -Pn is used to skip
the host discovery.
Note: MAC address spoofing technique uses spoofing a MAC address with the
MAC address of a legitimate user on the network. This technique allows you to
send request packets to the target machine/network pretending to be a
legitimate host.

32 | P a g e
• Switch to the Windows 10 machine (target machine). In the Wireshark
window, scroll-down and you can observe the captured TCP, as shown in
the screenshot.

• This concludes the demonstration of evading IDS and firewall using

various evasion techniques in Nmap.
• Close all open windows and document all the acquired information.

33 | P a g e
 Lab 05: Perform Networking Scan using Various
Network Scanning Tools
Ethical hackers and pen testers are aided in network scanning with the help of
various scanning tools, which make scanning a target network an easy task.

Overview of Network Scanning Tools

Scanning tools are used to scan and identify live hosts, open ports, running
services on a target network, location-info, NetBIOS info, and information
about all TCP/IP and UDP open ports. Information obtained from these tools
will assist an ethical hacker in creating the profile of the target organization
and to scan the network for open ports of the devices connected.

Task 01: Scan a Target Network using Metasploit

Metasploit Framework is a tool that provides information about security
vulnerabilities in the target organization’s system, and aids in penetration
testing and IDS signature development. It facilitates the tasks of attackers,
exploit writers, and payload writers. A major advantage of the framework is
the modular approach, that is, allowing the combination of any exploit with
any payload.
Here, we will use Metasploit to discover active hosts, open ports, services
running, and OS details of systems present in the target network.
• Before beginning this task, turn on Windows 10 and Kali Linux VMs.
• Switch to the Kali Linux virtual machine and login into it.
• Open a Terminal window and execute sudo su to run the programs as a
root user.
• Execute command msfconsole to launch Metasploit.

34 | P a g e
 • An msf command line appears. Type nmap -Pn -sS -A -oX Test
[Link]/24 and press Enter to scan the subnet, as shown in the
screenshot.
Note: Here, we are scanning the whole subnet [Link]/24 for active
hosts.
• Nmap begins scanning the subnet and displays the results. It takes
approximately 5 minutes for the scan to complete.
• After the scan completes, Nmap displays the host information for all the
targets in the given subnet along with open ports, service and OS
enumeration.

35 | P a g e
36 | P a g e
 • Type search portscan and press Enter. The Metasploit port scanning
modules appear, as shown in the screenshot.

• Here, we will use the auxiliary/scanner/portscan/syn module to

perform an SYN scan on the target systems. To do so, type use
auxiliary/scanner/portscan/syn and hit Enter.
• We will use this module to perform an SYN scan against the target IP
address range ([Link]-50) to look for open port 80 through the
eth0 interface.
Note: To do so, issue the below commands:
▪ set INTERFACE eth0
▪ set PORTS 80
▪ set RHOSTS [Link]-50
▪ set THREADS 20
Note: PORTS specifies the ports to scan (e.g., 22-25, 80, 110-900), RHOSTS
specifies the target address range or CIDR identifier, and THREADS specifies
the number of concurrent threads (default 1).
• After specifying the above values, type run and press Enter, to initiate
the scan against the target IP address range.

37 | P a g e
Note: Similarly, you can also specify a range of ports to be scanned against the
target IP address range.
• The result appears, displaying open port 80 in active hosts, as shown in
the screenshot.

• Now, we will perform a TCP scan for open ports on the target systems.
• To load the auxiliary/scanner/portscan/tcp module, type use
auxiliary/scanner/portscan/tcp and press Enter. Run show options
command to view module options.

38 | P a g e
 • Type set RHOSTS [Link] and press Enter.
Note: Here, we will perform a TCP scan for open ports on a single IP address
([Link]), as scanning multiple IP addresses consumes much time.
• Type run and press Enter to discover open TCP ports in the target
system.
Note: It will take approximately 20 minutes for the scan to complete.
• The results appear, displaying all open TCP ports in the target IP address
([Link]).

• Now that we have determined the active hosts on the target network,
we can further attempt to determine the OSes running on the target
systems. As there are systems in our scan that have port 53 open, we
will use the module scanner/smb/smb_version to determine which
version of Windows is running on a target and which Samba version is
running on a Linux host.
• To do so, first type back, to revert to the msf command line. Then, type
use auxiliary/scanner/smb/smb_version and hit Enter.
• We will use this module to run a SMB version scan against the target IP
address range ([Link]-50). To do so, issue the below commands:
o set RHOSTS [Link]-50
o set THREADS 11
• Type run to discover SMB version in the target systems.
• The result appears, displaying the OS details of the target hosts.

39 | P a g e
• You can further explore various modules of Metasploit such as FTP
module to identify the FTP version running in the target host. This
information can further be used to perform vulnerability analysis on the
open services discovered in the target hosts.
• This concludes the demonstration of gathering information on open
ports, a list of services running on active hosts, and information related
to OSes, amongst others.
• Close all open windows and document all the acquired information.

40 | P a g e
Conclusion
This lab provided a comprehensive understanding of the network scanning
phase in ethical hacking and penetration testing. Through practical
experimentation using tools such as Nmap, Zenmap, Wireshark, and
Metasploit, multiple scanning techniques were explored to identify active
hosts, open ports, running services, and operating system information within a
target network.
The exercises demonstrated how attackers and security professionals gather
critical information about network infrastructure before attempting
exploitation. Techniques such as host discovery, port scanning, service
enumeration, OS fingerprinting, and IDS/firewall evasion highlighted how
networks can be analyzed in depth to identify potential vulnerabilities.
Furthermore, the lab emphasized the importance of defensive measures such
as firewall configuration, port hardening, service monitoring, and intrusion
detection systems to minimize exposure to scanning activities. Observing
scanning traffic through Wireshark also helped in understanding how network
packets behave during reconnaissance.
Overall, this lab strengthened practical knowledge of network reconnaissance
and illustrated how scanning techniques form the foundation of both
penetration testing and cybersecurity defense strategies.

41 | P a g e
References
1. EC-Council. (2023). Certified Ethical Hacker (CEH v12) Official
Courseware. EC-Council.
2. Gordon Lyon (Fyodor). Nmap Network Scanning: The Official Nmap
Project Guide to Network Discovery and Security Scanning.
[Link]
3. Nmap Official Documentation
[Link]
4. Wireshark Foundation. Wireshark User Guide.
[Link]
5. Rapid7. Metasploit Framework Documentation.
[Link]
6. Scarfone, K., & Mell, P. (2007). Guide to Intrusion Detection and
Prevention Systems (IDPS). NIST.

42 | P a g e