Vulnerability › Module 3 › Lesson 2
Discovery Literacy
Read discovery concepts — nmap on $LAB_HOST only, never dorm or café ranges.
Visual · discovery_literacy
Discovery literacy. nmap on $LAB_HOST only. Original Cyberlium.
Opening
Discovery maps services on hosts you own — not a tour of the dorm subnet.
Discovery identifies live hosts and open ports/services on in-scope assets. Tools like nmap (-sV service version, -Pn when ICMP blocked) help analysts build service maps — when run against $LAB_HOST with written RoE. Cyberlium teaches command literacy and output reading on YOUR lab VM — not sweeps of classmate IPs or café Wi-Fi. Example lab-safe pattern: nmap -sV $LAB_HOST from your workstation — scope file open, notes chmod 600. You will NOT nmap 192.168.1.0/24, scan internet ranges, or publish neighbor port lists. Next: Scope List.
1. What discovery answers on scope
Is the host up? Which TCP/UDP ports respond? What service banners or versions appear? Discovery feeds the asset service column and scanner profiles — on $LAB_HOST only.
Analysts document command, timestamp, and scope in notes before interpreting results — same habit defenders use for audit trails.
Command guide
Try these commands — What discovery answers on scope
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Nmap reference — https://nmap.org/book/man.html NIST CSF Identify — https://www.nist.gov/cyberframework
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install nmap
macOS:
Command — copy this
brew install nmap
Windows:
Command — copy this
choco install nmap # or download https://nmap.org/download.html
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t18-lab.env" nmap -sn "$LAB_HOST" nmap -sV -T4 --top-ports 50 "$LAB_HOST"
═══ WINDOWS ═══
Command — copy this
nmap -sn 127.0.0.1 nmap -sV -T4 --top-ports 50 127.0.0.1
Primary tools to practice this lesson: nmap. Reference sites: Nmap reference (https://nmap.org/book/man.html); NIST CSF Identify (https://www.nist.gov/cyberframework). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. nmap literacy without misuse
Flags like -sV increase detail; aggressive timing on stranger networks creates noise and harm. Lab: single-host scan against $LAB_HOST after RoE check — not -sn sweeps across LANs you do not operate.
Tutorials showing dorm /24 scans get rewritten to $LAB_HOST before you copy habits.
3. Read output like an analyst
Port/state/service/version lines become inventory updates: 22/tcp open ssh OpenSSH_8.x, 80/tcp open http Apache. Map each to patch/CVE lookup later — no exploit attempts.
Ship: sample discovery note structure (command redacted to $LAB_HOST placeholder). Next: Scope List.
4. What you ship: discovery literacy note for $LAB_HOST
Document nmap -sV pattern on $LAB_HOST only. NEVER dorm /24, café Wi-Fi, internet ranges. chmod 600.
5. What you record before the next lesson
Date. Discovery command template with $LAB_HOST. NEVER LAN sweeps. File t18-m03-l02-discovery-literacy.txt chmod 600.
6. Wrong vs right: stranger nets vs YOUR lab assets
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
nmap 10.0.0.0/8 'to learn flags.' Post classmate port scan in Discord.
Right
Write discovery literacy for single-host $LAB_HOST scope. Next: Scope List.
Mission: discovery literacy template
1) Write nmap -sV $LAB_HOST as allowed pattern. 2) List three output fields you would record. 3) Add NEVER: dorm /24, café Wi-Fi. Run only if RoE names $LAB_HOST and lab brief allows.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor about reading nmap -sV output — not flags for dorm sweeps.
Knowledge Check
APPLY: Discovery on Cyberlium runs against:
Multiple choice
Knowledge Check
APPLY: True or False: nmap dorm subnet sweeps are in scope for discovery literacy.
True or False
Knowledge Check
APPLY: Discovery output primarily updates:
Multiple choice