NetworkEasy

Network Enumeration and Service Discovery

Performing comprehensive network reconnaissance against a target machine to identify open ports, running services, and potential attack vectors through systematic enumeration.

Overview

This writeup covers the fundamental methodology of network reconnaissance — the first phase of any penetration test. The target is a single machine on a private lab network. The goal is to identify all accessible services, determine software versions, and map potential attack surfaces without exploiting any vulnerabilities.

Reconnaissance

Reconnaissance started with a host discovery ping sweep across the /24 subnet to confirm the target is alive. A SYN scan across all 65535 TCP ports was performed to identify open ports. A follow-up UDP scan on the top 100 ports was also conducted.

Discovery

Service version detection (-sV) and default script scanning (-sC) provided detailed information about each service: OpenSSH 8.9p1 on port 22, Apache 2.4.54 on port 80, Nginx 1.22 reverse proxy on port 443 with a self-signed certificate, MySQL 8.0.31 on port 3306, and Apache Tomcat 9.0.65 on port 8080.

Exploitation

No exploitation was performed in this phase. However, identified attack vectors include: potential brute-force against SSH, MySQL remote access enabled, Tomcat manager interface exposed, and the self-signed certificate on HTTPS.

Explanation

Network enumeration is the systematic process of discovering hosts, open ports, services, and their versions on a target network. Each open port represents a potential entry point. Service version information helps identify known vulnerabilities (CVEs).

Mitigation

Close unnecessary ports and disable unused services. Restrict MySQL to localhost unless remote access is explicitly required. Remove or restrict access to administrative interfaces like Tomcat Manager. Replace self-signed certificates with proper CA-signed certificates.

Code Samples

Nmap scanning commands for comprehensive enumeration

1# Host discovery ping sweep
2nmap -sn 10.10.10.0/24
3
4# Full TCP port scan with service detection
5nmap -sS -sV -sC -p- -oN full_tcp_scan.txt 10.10.10.100
6
7# Top 100 UDP ports
8nmap -sU --top-ports 100 -oN udp_scan.txt 10.10.10.100

Nmap scan results showing open ports and services

1PORT     STATE SERVICE    VERSION
222/tcp   open  ssh        OpenSSH 8.9p1 Ubuntu 3
380/tcp   open  http       Apache httpd 2.4.54
4443/tcp  open  ssl/http   nginx 1.22.0
53306/tcp open  mysql      MySQL 8.0.31
68080/tcp open  http-proxy Apache Tomcat 9.0.65