Network & System Security

A typical network intrusion moves through six stages: discovery (which hosts are alive), scanning (which ports are open), enumeration (what software and version runs there), exploitation (gaining a foothold), privilege escalation (user to root), and pivoting (reaching new hosts from an owned box). The sequence repeats from every machine you control.

The -sn flag tells Nmap to perform host discovery only and skip port scanning. It answers just one question: which addresses on the network have a live machine responding. It is the fastest and quietest first step before you scan ports on the hosts that answered.

Scanning answers which ports on a live host are open. Enumeration goes further and asks what exactly sits behind an open port: the software name, its version, interesting files, usernames and configuration. Scanning is mechanical; enumeration is where most skill and time go, because it decides whether exploitation is even possible.

Only scan systems you own or have explicit written permission to test. Scanning, brute-forcing or exploiting a network you are not scoped for is a criminal offence in most jurisdictions. The course uses an isolated cloud lab range so you can practise aggressive techniques safely and legally.

Exploits are specific to a particular software and version, so picking the right technique depends on knowing exactly what runs behind each port. Careful enumeration turns a vague open port into a precise target, which is why it typically consumes the largest share of effort and makes later exploitation look effortless.

They map onto the reply a SYN scan gets. A SYN/ACK back means open: something is listening. A RST means closed: the host answered but nothing is on that port. No reply at all usually means filtered: a firewall silently dropped the probe, so you learned nothing conclusive and should re-probe with different timing or scan types.