Vulnerability & Network Scanning: Tools, Techniques, Tactics

Explore network topology: bus, star, mesh, and hybrid; understand how topology shapes scanning with ping sweep, port scanning, service scanning, OS fingerprinting, and vulnerability scanning using nmap and mass scan.

Learn basic nmap usage for network discovery and security auditing, including host discovery, port scanning, and version detection, plus operating system detection and the scripting engine for vulnerability checks.

Masscan is a high-speed network scanner that can quickly scan large IP ranges or the internet, using port options and sudo requirements, with JSON or XML output.

Identify and mitigate vulnerabilities before attackers exploit them by using manual and automated vulnerability scanning tools like Nessus, Openvas, and coalesce to prioritize CVEs, misconfigurations, and weak passwords.

Explore vulnerability scanning with Nessus, including installing Nessus Essentials for up to 16 IPs, configuring scans, interpreting CVEs, and prioritizing fixes for Apache, PHP, and RDP vulnerabilities.

Install and configure Openvas, access its web interface on port 9392, create a Metasploitable three target, run scans, and review high and critical findings.

Explore web application vulnerability scanning with OWASP ZAP, an open source security scanner used for automated and manual testing, featuring active and passive scanning, spidering, and session management.

Explore Nikto, an open-source web server scanner that detects vulnerabilities, outdated software, misconfigurations, and TLS issues across ports; run with Nikto -h <host> and interpret terminal results.

Master operating system detection with nmap by analyzing tcp/ip stack fingerprints, banner responses, and service versions to identify Linux and Windows targets, with caveats about accuracy.

Explore advanced nmap scans including no-ping (-Pn), Christmas (-sX), fin (-sF), UDP, and null (-sN) scans, with live Wireshark monitoring on Kali Linux.

Explore advanced evasion techniques in Nmap, including fragmentation, decoy scanning, and timing templates to bypass firewalls, IDs/IPS, while learning their limitations against reassembly and advanced systems.

Code a Python network scanner from scratch, implementing port scanning, banner grabbing, and basic vulnerability detection using nmap for operating system discovery and service banners.

Document and structure scanning results from nmap or Nessus into a clear executive summary and detailed findings with IPs, ports, vulnerabilities, and mitigations; automate scheduling for continuous vulnerability management.