Module 3: Active Reconnaissance: Scanning & Enumeration
Understand what host discovery, port and service scanning and service enumeration are, what their results reveal, and how to turn raw results into a prioritised host and service table with hardening advice. All work uses supplied results from authorised, simulated scans.
- Level
- Beginner
- Study time
- 6 hours
- Lessons
- 6
- Practice labs
- 3
- Assessments
- 2
- Format
- Self-paced, online
What you will learn
By the end of this course you will be able to:
- Fingerprint a network from supplied results and identify its services and entry points.
- Interpret port states, service banners and version strings to find outdated or exposed services.
- Produce a prioritised host table with a recommended hardening action for each host.
- Explain scan authorisation, impact and how defenders detect scanning.
Before you start
Module 2: Passive Reconnaissance & OSINT
Tools you will use
Course outline
6 lessons in 2 modules.
Sub-module 3.1: Host discovery & scanning
- Host discovery and port states
- Service and version detection
- Scan impact and how defenders see scanning
Sub-module 3.2: Service enumeration
- Service enumeration: web, SMB, FTP and SNMP
- Writing a clean, prioritised host map
- Worked example: from scan results to a host table
Practice labs and assessments
Labs run in the browser as simulations. They never touch a real system.
3 practice labs
- Read a host discovery and port report Beginner, 20 min
- Interpret service enumeration results Intermediate, 25 min
- Major Lab: Prioritise the host table Intermediate, 40 min, final lab
2 assessments
- Module 3 knowledge check
- Module 3 final quiz
The pass mark is 70%. You can retake an assessment.
Take Module 3: Active Reconnaissance: Scanning & Enumeration
Request access and your instructor will set up your account.