Unit 5: Scanning, Enumeration, and Vulnerability Assessment
Lesson at a glance
| Item | Detail | | --------------------- | ------------------------------------------------------------------------------------------------------ | | Suggested length | 6 × 60 minutes | | Recommended placement | Weeks 6–7 of Cyber II | | Prerequisite | Units 1–4 | | Materials | Kali, Metasploitable2 (or Vulnhub equivalent), Greenbone/OpenVAS or Nessus Essentials, CVSS calculator |
Safety: All scanning targets are lab targets only. Scan one Internet host = course fail and possible legal exposure.
Learning objectives
By the end of this unit, students can:
- Use nmap fluently across host discovery, port scanning, version detection, and scripting (NSE).
- Enumerate services to extract usernames, shares, software versions.
- Run an authenticated and unauthenticated vulnerability scan with Greenbone/OpenVAS or Nessus Essentials.
- Score a vulnerability using CVSS v3.1 with a written rationale.
- Differentiate true positive, false positive, and "not exploitable in this context."
- Produce a vulnerability assessment report with severity-prioritized findings.
Vocabulary
- Host discovery - Finding live hosts on a network.
- Port scan - Identifying open TCP/UDP ports.
- Service enumeration - Identifying software + version on each port.
- NSE (Nmap Scripting Engine) - Lua scripts for deeper checks.
- Authenticated scan - Scanner has credentials, sees inside the host.
- CVSS - Standardized 0–10 vulnerability severity score.
- Validation - Manually confirming a scanner's finding before reporting.
Pacing
| Day | Focus | Deliverable | | --- | --------------------------------- | ------------------------------------ | | 1 | Nmap deep dive: discovery + ports | Annotated nmap output | | 2 | NSE scripting + service enum | Service inventory of Metasploitable2 | | 3 | Greenbone/OpenVAS scan (unauth) | Scan report PDF/HTML | | 4 | Authenticated scan + diff | Diff between auth/unauth scans | | 5 | CVSS scoring + finding validation | Scored, validated findings | | 6 | Report write-up | 6–10 page vulnerability assessment |
Day 1 - Nmap
# Host discovery on the lab subnet
nmap -sn 192.168.56.0/24
# TCP top-1000 ports + version detection
nmap -sV 192.168.56.20
# All TCP ports, default scripts, version detection
nmap -p- -sV -sC -oA scan-target-20 192.168.56.20
# UDP top ports (slow; explain why)
nmap -sU --top-ports 50 192.168.56.20
# OS detection
nmap -O 192.168.56.20
Discuss outputs line by line. Lock in the four output formats: -oN normal, -oG grepable, -oX xml, -oA all.
Day 2 - NSE + service enumeration
# SMB share enumeration
nmap --script smb-enum-shares,smb-enum-users -p 139,445 192.168.56.20
# HTTP enumeration
nmap --script http-enum,http-title,http-headers -p 80,443 192.168.56.20
# Vulnerability scripts (read each script before running it)
nmap --script vuln -p 80,443 192.168.56.20
# Manual banner grabbing
nc -nv 192.168.56.20 21
Explain: NSE is powerful but not subtle. --script vuln will trigger IDS in real environments. Use deliberately.
Day 3 - Greenbone/OpenVAS (unauthenticated)
Walk through:
- Target definition (single IP).
- Scan config: full and fast.
- Run scan; expect 20–60 minutes on Metasploitable2.
- Review report HTML.
- Pick the top 5 findings and note severity, vector, and what the scanner used to determine the finding.
Day 4 - Authenticated scan + diff
Re-run with SMB / SSH credentials provided by teacher. Compare:
- Authenticated scan typically finds 2–5x more issues (missing patches visible from inside).
- Discuss: this is why "we ran a scan" doesn't mean the same thing in every shop.
Day 5 - CVSS + validation
Use the FIRST CVSS calculator. For 5 findings, compute the v3.1 base score and write a 2-sentence rationale per metric:
- Attack Vector (Network/Adjacent/Local/Physical)
- Attack Complexity (Low/High)
- Privileges Required (None/Low/High)
- User Interaction (None/Required)
- Scope (Unchanged/Changed)
- C/I/A impact (None/Low/High)
Then validate: actually try to confirm the finding. Did it work? If not, mark as "not exploitable in this context - scanner likely matched on banner."
Day 6 - Report
Template:
# Vulnerability Assessment Report - Lab Target 192.168.56.20
## Executive Summary
- 1 paragraph for non-technical leadership.
## Methodology + Tools
## Scope + Authorization
## Findings (sorted by CVSS, descending)
- Title
- CVSS v3.1: <score> (<vector string>)
- Description
- Evidence (screenshots / command output)
- Validation status (confirmed / unconfirmed / not exploitable)
- Recommended remediation
- References (CVE / vendor advisory)
## Appendix: full scanner output
Common misconceptions
- "Higher port count = more dangerous host." - Severity is per-finding, not per-port. One Critical on one port is worse than 50 Lows on 50 ports.
- "The scan report is the engagement." - A scan is raw input. A vulnerability assessment is the human work of validating, prioritizing, contextualizing.
Assessment
- Day 2 service inventory.
- Day 3 + 4 scan reports.
- Day 5 scored + validated findings (5 minimum).
- Day 6 report - rubric scored.
Career connection
Vulnerability management analysts: $75K–$110K. The AVP Vulnerability Management at a F500 company makes $250K+ and started here.
Homework
Read CISA KEV catalog intro. Pick one CVE in KEV, find a public PoC link, and write 1 paragraph describing what an attacker can do and what the patch is.