Penetration › Module 4 › Lesson 1
Ports and Services
Port scanning maps listening services on scope — enumerate $LAB_HOST only, never stranger hosts.
Visual · pentest_ports_services
Ports/services literacy. $LAB_HOST only. Original Cyberlium.
Opening
Ports tell you where to look — not where you are allowed to look.
Service enumeration begins with port scanning: identifying TCP/UDP listeners on in-scope hosts. Common literacy tools include nmap port scans, rustscan concepts, and manual netcat probes — all against $LAB_HOST only after RoE permits active recon. Open ports on stranger machines are not invitations. Cyberlium teaches port/service vocabulary without dorm sweeps or café gateway scans. You log every scan: tool, flags, target=$LAB_HOST, time. Next: Versioning.
1. Ports map attack surface on scope
Each open port suggests a service: 22 SSH, 80 HTTP, 445 SMB. Analysts build a service table per host — starting with $LAB_HOST. Unexpected ports trigger versioning next lesson, not immediate exploitation.
Scanning ports on hosts outside scope — classmates, neighbors, production without contract — is unauthorized access territory.
Command guide
Try these commands — Ports map attack surface on scope
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Service version — https://nmap.org/book/man-version-detection.html Default scripts — https://nmap.org/book/nse-usage.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install nmap
macOS:
Command — copy this
brew install nmap
Windows:
Command — copy this
choco install nmap # or download https://nmap.org/download.html
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t19-lab.env" nmap -sV -sC -T4 --top-ports 50 "$LAB_HOST"
Primary tools to practice this lesson: nmap. Reference sites: Service version (https://nmap.org/book/man-version-detection.html); Default scripts (https://nmap.org/book/nse-usage.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Scan discipline and rate limits
Document scan type: full, top ports, UDP sample. Note timing templates and RoE windows. Enterprise engagements cap scan rates to protect production; lab VMs still deserve logged commands.
Copy-pasting tutorial scans against public ranges violates Cyberlium ethics — rewrite target to $LAB_HOST.
3. Service table as enumeration artifact
Pentest notes include port, protocol, initial service guess, and next-step column (version probe, manual browse). Empty cells are fine — honesty beats fabricated findings.
Ship: service table header row for $LAB_HOST. Next: Versioning.
4. What you ship: service table template for $LAB_HOST
Table columns: port, proto, service guess, next step. Target=$LAB_HOST only. NEVER stranger scans. chmod 600.
5. What you record before the next lesson
Date. Service table template. $LAB_HOST named. File t19-m04-l01-ports-services.txt chmod 600.
6. Wrong vs right: stranger nets vs YOUR lab VMs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Full nmap on dorm /24. Scan café router 'because port 80 is interesting.'
Right
Write service table template for $LAB_HOST. Next: Versioning.
Mission: template service table for YOUR lab
1) Define table columns for port enumeration. 2) Set host = $LAB_HOST only. 3) chmod 600. Never scan hosts not in RoE.
Stuck? Ask Cyberlium AI Mentor
Port scan logs are evidence — write them like someone will audit you.
Knowledge Check
APPLY: Port scanning in Cyberlium targets:
Multiple choice
Knowledge Check
APPLY: True or False: Open ports on stranger hosts authorize scanning them.
True or False
Knowledge Check
APPLY: Service enumeration notes should log:
Multiple choice