The Art of Network Penetration Testing

3 Discovering network services

This chapter covers

• Understanding network services from an attacker’s perspective
• Network service discovery using Nmap
• Organizing and sorting Nmap scan output
• Creating protocol-specific target lists for vulnerability discovery

In the last chapter, you learned that the information-gathering phase is broken into three separate sub-phases:

1. Host discovery

2. Service discovery

3. Vulnerability discovery

You should be finished with the first sub-phase already. If you haven’t done host discovery against your target environment yet, go back and complete chapter 2 before continuing. In this chapter, you learn how to execute the second sub-phase: service discovery. During service discovery, your goal is to identify ...