Metasploitable: Nmap Scanning and Service Enumeration.
Disclaimer
All information and tools discussed here are provided strictly for educational and informational purposes only and performed on an isolated home lab using an intentionally vulnerable software and intended to help users better understand cybersecurity concepts and defensive practices. No content should be interpreted as encouragement or guidance for any illegal, unethical, or malicious activity.
As a penetration tester, you have a hacking engagement with Northgate Logistics, to assess their internal network.
Before any testing begins, you receive a signed and stamped authorization letter from the CISO’s office, along with a Rules of Engagement document defining scope: a specific subnet housing internal servers, testing window of business hours only. Like the same methodology used against a live enterprise, this simulation is carried out on Kali Linux acting as the attack machine while Metasploitable acts as the target (victim) machine.
(Metasploitable is a vulnerable virtual machine to safely practice penetration testing.)
As with an enterprise, having received approval and authorization a penetration tester begins the scanning and enumeration phase.
Host Discovery :
Here you carry out a ping sweep across the authorized subnet to identify live hosts.
nmap -sn 10.0.2.0/24
Port and Service Scanning :
nmap sV 10.0.2.5
As shown in this scan, there are 977 closed ports and a goldmine of vulnerable or opened services, ports, state, and versions which is a raw data for identifying outdated or misconfigured systems. It also shows us the MAC address of the device.
I step it up a notch by enumerating with an aggressive scan,
nmap -A 10.0.2.5An aggressive scan will enable OS detection, version detection, script scanning and traceroute.
The aggressive scan exposes that FTP allows anonymous login,
ftp <TARGET IP>When prompted
Get Samuel Esu’s stories in your inbox
Join Medium for free to get updates from this writer.
Name: Anonymous
Password: Anonymous@
Anyone can reach this server with no credentials, download files and if write access is also misconfigured, can upload files too, also vsftpd 2.3.4 is a vulnerable version with a backdoor unrelated to the anonymous login. if a username containing :) is sent during login, it opens a listener on port 6200 and gives a root shell.
This scan alone surface a number of serious issues on a single host, Metasploitable makes these vulnerabilities intentionally obvious for learning purposes, but the underlying lessons (patch old software, disable unnecessary anonymous access, validate certificates and don’t rely on any single layer of defense)
From i discovered i make a decision to narrow down on a vulnerability on a single port, say port 80
nmap --script vuln -p 80 10.0.2.5
The initial -A scan told us a a lot about which services were running, but it didn’t dig into web application sitting on port 80. Nmap’s vulnerability scripts is the right tool for that.
This is where things get interesting. http-enum brute-forces a list of common file and directory names against the server and reports anything that responds:
/tikiwiki/ — a TikiWiki CMS installation. TikiWiki has its own long history of CVEs, including SQL injection and remote code execution flaws, so its mere presence is worth further investigation.
/test/ — a leftover test page. These are often forgotten by developers and left unprotected, sometimes containing debug output or unintended functionality.
/phpinfo.php — arguably the most valuable single finding here. The phpinfo() function dumps the server’s entire PHP configuration: exact version numbers, loaded modules and extensions, internal file paths, and environment variables. For an attacker, this is a reconnaissance goldmine — it tells them precisely which known exploits might apply.
/phpMyAdmin/ — a web-based database administration panel exposed directly to the internet. If it’s protected by default or weak credentials (common in real-world misconfigurations), this is a direct path to the entire database — and in some configurations, a path to code execution on the server itself.
/doc/ and /icons/ — both have directory listing enabled, meaning visitors can browse the raw file structure instead of only seeing the pages the developer intended. Directory listings frequently leak backup files, old configuration files, or exposed source code.
/index/ — flagged simply as a potentially interesting folder, worth a manual look.
Finally, three scans with nmap : an aggressive full scan, a targeted web vulnerability scan, and manual follow-up, what those scans surfaced gave more than a dozen distinct exploitable issues. An outdated FTP server with a built-in backdoor that requires no login credentials. A weak SSH key generation flaw baked into an entire OS release
A database admin panel sitting wide open with default credentials. None of these required advanced skill to find. Metasploitable’s specific flaws is to build the habit of reading scan output critically asking what does this version number tell me, what does this open port actually expose, and what happens if this specific misconfiguration existed in production enviroment.
That last question is the one that matters most outside the lab.
