Service enumeration & NSE¶

MITRE ATT&CK: T1046 Network Service Discovery · T1595.002 Vulnerability Scanning · Tactic: Reconnaissance / Discovery · Last updated: 2026-10-13

Summary

An open port is only a number. -sV turns it into a product and version, and NSE scripts query the service for more. The version is what you search for CVEs with.

Version detection¶

sudo nmap 10.129.2.28 -p- -sV --stats-every=5s -v

Flag	Meaning
`-sV`	Probe open ports to identify service and version
`-v`	Print open ports as soon as they are found
`--stats-every=5s`	Progress line every 5 seconds
`--version-trace`	Show the probes and matches `-sV` used

Nmap first reads the banner the server volunteers after the handshake, then falls back to sending signature probes (slower). Nmap prints only the parsed part of the banner, so something useful can be hidden. Compare:

sudo nmap 10.129.2.28 -p 25 -sV -Pn -n --disable-arp-ping --packet-trace
nc -nv 10.129.2.28 25

Nmap showed Postfix smtpd; nc returned 220 inlane ESMTP Postfix (Ubuntu) — the OS family was in the raw banner. Use --packet-trace/--version-trace to see it inside Nmap, or nc when you want the raw conversation. Either works; banners can also be removed or faked by the admin, so treat them as hints.

NSE categories¶

Scripts are written in Lua. 14 categories: auth, broadcast, brute, default, discovery, dos, exploit, external, fuzzer, intrusive, malware, safe, version, vuln.

sudo nmap <ip> -sC                                  # default category
sudo nmap <ip> --script vuln                        # a category
sudo nmap <ip> -p 25 --script banner,smtp-commands  # named scripts
sudo nmap <ip> -p 80 -A                             # -sV -O --traceroute -sC
sudo nmap <ip> -p 80 -sV --script vuln              # vuln needs -sV for useful matches

How to read it: http-enum listing /wp-login.php and a WordPress version tells you the CMS and exact version to look up; smtp-commands showing VRFY means user enumeration is possible; vulners prints CVE IDs with CVSS scores for the detected CPE.

Remember that vulners/vuln results are version matches, not confirmed exploitability. Verify manually before putting a finding in the report.

Pentester view¶

-sC -sV on discovered ports is the standard second pass.
Be careful with intrusive, dos, brute, exploit and fuzzer: they can lock accounts or crash services. Do not run them on production unless scope allows.
-A also runs OS detection and traceroute; fine in a lab, think twice on fragile networks.

Defender view¶

NSE HTTP scripts send a recognizable User-Agent unless changed (look for Nmap Scripting Engine in http.log / proxy logs).
-sV produces many short connections with odd probe strings; services see malformed requests. Web servers log 400/404 bursts, SMTP logs unknown commands.
Reducing banner detail (ServerTokens Prod, reverse proxy) slows version-based CVE lookup but isn't a fix on its own.

CPTS exam notes

CTF-style flags often sit in a banner or in NSE output (banner, http-title, smtp-commands). If a flag is not in -sV, rerun with --script banner or connect manually.