Attacking networks and services
Recon in Reconnaissance gave you a list of hosts and open ports on the lab store-server network. This lesson turns that into a ranked list of services worth testing, shows you how to read what each service exposes, how a vulnerability scanner maps a version to a known weakness, and the difference between a scanner flag and a finding you have safely confirmed. Every target here is the practice network built for the course.
By the end you can
- Turn a list of open ports into a prioritised list of services to test
- Enumerate what a service exposes: versions, default configuration, anonymous access, management interfaces and shares
- Map a service version to a CVE, read its CVSS score and check the CISA KEV catalogue
- Tell "a scanner flagged it" apart from "I safely confirmed impact", and validate without risking an outage
- Name the common service weaknesses, the fix for each, and how a defender spots the attempt in logs
The everyday picture
Picture walking the back corridor of a large office building after a survey. Recon drew you the floor plan. Now you pass a row of service counters. Each open counter has a sign saying what it does, and many show the model number of the machine behind it: "Window 3, payments terminal, model 2.1". You note which counters are open, which are meant to be staff-only but have no lock, which still run equipment the maker recalled years ago, and which have a drawer left open that anyone could reach into.
You do not force any drawer. A good surveyor reports "this counter is open, runs a recalled model, and the drawer slides out" without emptying it, because the job is to show the risk and recommend the fix, not to cause a mess. Testing network services is the same walk. You list what is running, read the version and settings each service announces, match that against lists of known faults, and confirm the few that matter in the gentlest way the rules allow.
From a port list to a ranked target list
Recon leaves you with hosts and open ports, often dozens. You cannot test everything at once, and most open ports are not worth much. Prioritisation is the first real skill of this phase. Rank each service by three questions, in this order:
- What does it guard? A database with customer or price data outranks a printer. Follow the data, the way you followed the money in Thinking like an attacker.
- Who can reach it? A service reachable from the whole store network is a bigger target than one bound to the local machine or shut inside a management segment. Network segmentation is exactly what shrinks this answer.
- How out of date is it? An old version with public, well-documented faults is a cheaper target than a current, patched one.
On the lab store-server network, that ranking puts the two servers holding price and stock data, reachable from the whole store network, above a management jump box that only one segment can reach. The map below is what you draw before you touch anything: segments, hosts and the services on each, with the top targets marked.
Quick check
On the lab network you find an open printer-management port on a store server and an exposed database port on a management-segment host. The database is reachable only from the management segment; the printer is reachable from the whole store network. Which do you rank higher to test first?
Prioritisation is not one rule. The database guards more but sits behind segmentation, while the printer is exposed but holds little, so you weigh value and reach together rather than letting one question decide alone. Scope is set by the rules of engagement, not by which segment a host is in.