45. Practice Exercises with Hints
45.6 Kali Recon, Scan and Enum – Host-Only Only
whois/dig ideas, Nmap timing, service enum – only .20 / .30 lab targets. Slow timing -T2 in shared labs; never DoS.
| Exercise | Task | Hint |
|---|---|---|
| E1 | nmap -sS -T2 -p- against Metasploitable .20 only – top 5 open ports note |
Lab only; compare with your earlier chapter notes |
| E2 | Service version scan on those ports – what would Blue patch first? | -sV lab only; prioritise ancient FTP/SMB/HTTP |
| E3 | dig / whois on a domain you own or example.com documentation habit |
Recon on third parties without authorisation = out of scope |
| E4 | Gobuster/dirb against OWN DVWA – one interesting path | Wordlist + rate polite; fix by removing leftovers |
| E5 | Write Blue detection: what log shows port scan? | Firewall / IDS spikes; cloud SG reject metrics; Suricata/Snort awareness |
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
Full port sweep + version probe on lab .20 |
IDS/IPS; rate alerts; shrink attack surface; patch |
| Directory brute on lab web | Remove backup files; WAF; monitor 404 storms |
Ravindra Bagale's Tip
Students run -T5 -A against a production IP. The book's rule: host-only + slow. Interview: "I scan only authorised scopes." Say it clearly.
Ravindra Bagale's Tip – मराठी
Students -T5 -A production IP वर चालवतात. Book rule: host-only + slow. Interview: "I scan only authorised scopes." Clear बोला.
Ravindra Bagale's Tip – हिंदी
Students -T5 -A production IP पर चलाते हैं. Book rule: host-only + slow. Interview: "I scan only authorised scopes." Clear बोलो.
Lab
Kali 192.168.56.10 → Metasploitable 192.168.56.20: SYN scan selected ports, save nmap -oN lab-scan.txt. Highlight three findings + one Blue fix each. No internet targets.
Real incident: WannaCry ransomware (2017)
Public reporting (national CERTs, Microsoft, major press) described global ransomware using an EternalBlue-class SMBv1 exploit path against unpatched Windows systems, with worm-like spread inside networks. Weakness themes: missing patches + legacy SMB exposure. Defence for enum chapter: know what SMB means on a scan, patch, disable SMBv1 where possible, segment. Source: Microsoft security guidance and CERT advisories (verify).