Port scanning, also called service discovery or protocol enumeration, identifies which ports and services are active on a networked device. Tools like Nmap and its graphical front end Zenmap make it possible to quickly surface open ports, running services, version numbers, and operating system details that can inform further security testing.
Port Scanning with Nmap
Another easy thing we can do is port scanning, and we can use Nmap to do that as well. One thing to note is that port scanning can go by many different names. It could be protocol scanning, could be service discovery, protocol enumeration, or service discovery.
The reason why port, protocol and service could all be somewhat interchangeable is because they kind of mean the same thing when it comes to networking. They actually mean something different, but there is some correlation between all of those. Let me explain here. We've got a server right here. Let's say that server is running a web service, so the web service is up and running on here. Maybe it's Apache, and maybe we are hosting out web pages through that web service. Well, it has a port that's associated with that web service, and that's port 80. And there's a protocol that's associated with that, which is HTTP. So we have a protocol that is associated with a port that's associated with a service. In this case right here, it's Apache that's running on there and it's some sort of web services. So that is why those are all interchangeable.
What we can do is, once we discover that this is live, we can do a port scan and say, "Hey, are you open on port 80? Hey, are you open on port 443?" to see if those web services are up and running. 443 is associated with HTTPS, which is the secure way of that. So that is protocol scanning, and we can do protocol scanning on the devices on their network to see what services are available on this network by discovering the service. Maybe we discover something about it, like maybe it's being hosted insecurely — for instance, port 80 right here is an insecure protocol, HTTP just sends things insecurely — so maybe we can leverage that somehow.
Just a reminder that this is for ethical hacking purposes only. Make sure you only do this on a network that either you own or have gotten permission to carry out these techniques on.
Let's go ahead and use Nmap to scan some ports to see what that looks like. Or more specifically, I'm going to use Zenmap. Zenmap is like the front end to Nmap, but it's still using Nmap on the back end. In fact, we see that it says Nmap right there — that's the command it's issuing.
So I'm going to choose a target. In this case, I'm going to choose 10.1, we're going to do 30.23, and so it's going to be just a single one here. I want to do an intense scan plus — we're going to do TCP ports and see what TCP ports are available on here. I'm going to hit scan, and it's going to go through the process of testing out these TCP ports to see what's live on it. You can see it's going through that scan now.
It finished up, and it took about 30 seconds, and it gave us a wealth of information. If I scroll up, we see that port 21 is open, which is an FTP server. FTP is great because a lot of times there's a password to get into that, but the password is sent in clear text. So if we could intercept that message, we could take a look at the password and be able to get into that system. That's definitely a target that we could look at.
It's also got port 80, which is HTTP, also all in clear text, so that could be something we could hack. We've also got 3389, so RDP is set up on it. And we've got another web page here, or website, that's running HTTP.
We also see what versions are running of this. We can see that it's Apache that's running the web services, and we even see the version of it, and we see that it's on Raspbian. So this is a Raspberry Pi. It's got a ton of information in here: what Linux version it's on, all the OS detail here, the uptime guess here of 46 days. Just a crazy amount of information just by this simple port scan that we did on this.
Here's our attack card on network scanning. Network scanning is scanning for devices, for open ports and services. So we do a scan of a computer on this network and scan all those, and we discover different ports, different protocols and different services that are up and running that we can leverage for our attack.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →