Service Enumeration & Banner Grabbing with Nmap

What Is Service Enumeration?

Service enumeration is the process of identifying running network services, open ports, software versions and configuration information.

For example, a server may have SSH on port 22, HTTP on port 80 and HTTPS on port 443.

22/tcp    open    ssh
80/tcp    open    http
443/tcp   open    https
3306/tcp  open    mysql

How Service Enumeration and Banner Grabbing Work

Important Ports for Service Enumeration

Install Nmap on Kali Linux

Nmap is a network scanner used for host discovery, port scanning and service identification.

Step 1 — Installation

sudo apt update
sudo apt install nmap

Step 2 — Verify Installation

nmap --version

Nmap version X.YZ
Platform: x86_64-pc-linux-gnu

Basic Nmap Port Scanning

A port scan checks which network ports are open, closed or filtered.

Basic Scan

nmap 192.0.2.10

Scan Specific Ports

nmap -p 22,80,443 192.0.2.10

Scan All TCP Ports

nmap -p- 192.0.2.10

PORT     STATE  SERVICE
22/tcp   open   ssh
80/tcp   open   http
443/tcp  open   https

TCP SYN and TCP Connect Scanning

TCP SYN Scan

Sends a SYN packet to examine the port response without normally completing the TCP handshake.

sudo nmap -sS -p 22,80,443 192.0.2.10

TCP Connect Scan

Uses the operating system to establish TCP connections.

nmap -sT -p 22,80,443 192.0.2.10

UDP Port Scanning

UDP scanning can identify services such as DNS, NTP and SNMP.

sudo nmap -sU -p 53,123,161 192.0.2.10

PORT     STATE         SERVICE
53/udp   open          domain
123/udp  open|filtered ntp
161/udp  closed        snmp

open|filtered means Nmap cannot reliably tell whether the port is open or filtered.

What Is Banner Grabbing?

Banner grabbing is a technique used to collect information that a network service reveals when a client connects or sends a request.

A banner may contain the software name, version, protocol or server information.

SSH-2.0-OpenSSH_9.6

This example suggests that the service uses SSH protocol version 2 and reports OpenSSH version 9.6.

Types of Banner Grabbing

Important Banner Grabbing Tools

Banner Grabbing with Netcat

What is Netcat? A networking utility used to establish TCP or UDP connections and exchange data.

Step 1 — Install Netcat

sudo apt update
sudo apt install netcat-openbsd

Step 2 — Grab an SSH Banner

nc -nv -w 5 192.0.2.10 22

Connection to 192.0.2.10 22 port [tcp/*] succeeded!
SSH-2.0-OpenSSH_9.6

Step 3 — Read an FTP Banner

nc -nv -w 5 192.0.2.10 21

220 FTP server ready

HTTP Banner Grabbing with curl

HTTP servers may reveal information in response headers, including the server software or framework.

Step 1 — Install curl

sudo apt update
sudo apt install curl

Step 2 — Inspect HTTP Headers

curl -I https://example.com

HTTP/2 200
server: nginx
content-type: text/html
cache-control: max-age=3600

The server header may identify the web server, but many sites remove or modify this information.

Show Detailed Connection Information

curl -v -I https://example.com

TLS Information Gathering with OpenSSL

OpenSSL can establish TLS connections and display information about certificates and negotiated encryption settings.

Step 1 — Install OpenSSL

sudo apt update
sudo apt install openssl

Step 2 — Inspect a TLS Connection

openssl s_client -connect example.com:443 -servername example.com

CONNECTED
Certificate chain
 0 s:CN = example.com
   i:CN = Example Certificate Authority

Protocol: TLSv1.3
Cipher: TLS_AES_256_GCM_SHA384

Simplified example. Real OpenSSL output contains additional certificate and handshake details.

Nmap Service Version Detection

Nmap uses service probes and response patterns to identify software and possible versions.

Detect Service Versions

nmap -sV -p 21,22,80,443 192.0.2.10

PORT    STATE SERVICE  VERSION
21/tcp  open  ftp      FTP server
22/tcp  open  ssh      OpenSSH 9.x
80/tcp  open  http     Apache httpd 2.4.x
443/tcp open  ssl/http nginx

Operating System Detection

sudo nmap -O 192.0.2.10

NSE Scripts for Service Enumeration

NSE scripts help collect more information from identified network services.

Run Default Scripts

nmap -sC -p 22,80,443 192.0.2.10

Combine Scripts and Version Detection

nmap -sC -sV -p 22,80,443 192.0.2.10

Run HTTP Title Script

nmap -p 80 --script http-title 192.0.2.10

80/tcp open http
|_http-title: Example Website

HTTP and HTTPS Service Enumeration

Web service enumeration helps identify page titles, HTTP headers and server information.

Nmap HTTP Headers

nmap -p 80,443 --script http-headers 192.0.2.10

Identify Web Technologies

whatweb https://example.com

SSH Service Enumeration

SSH enumeration can identify server versions and supported cryptographic algorithms.

nmap -sV -p 22 192.0.2.10

nmap -p 22 --script ssh2-enum-algos 192.0.2.10

22/tcp open ssh
| ssh2-enum-algos:
|   kex_algorithms:
|     curve25519-sha256
|   server_host_key_algorithms:
|     ssh-ed25519

FTP Service Enumeration

FTP enumeration identifies server information and checks whether anonymous access is enabled.

nmap -sV -p 21 192.0.2.10

nmap -p 21 --script ftp-anon 192.0.2.10

21/tcp open ftp
| ftp-anon:
|_  Anonymous FTP login allowed

SMB Service Enumeration

SMB commonly runs on TCP port 445 and supports network file sharing.

Identify SMB Protocol Versions

nmap -p 445 --script smb-protocols 192.0.2.10

Enumerate SMB Shares

nmap -p 445 --script smb-enum-shares 192.0.2.10

445/tcp open microsoft-ds
| smb-protocols:
|   dialects:
|     2.1
|     3.0
|_    3.1.1

DNS Service Enumeration

DNS commonly uses port 53 over UDP and TCP. It resolves domain names into IP addresses.

Detect DNS Service

sudo nmap -sU -sV -p 53 192.0.2.10

Query DNS Records

dig example.com A +short
dig example.com MX +short
dig example.com NS +short

Complete Service Enumeration Workflow

Replace the documentation IP address with your authorized lab target.

Step 1 — Discover Open Ports

nmap --top-ports 100 192.0.2.10

Step 2 — Grab Service Banners

nc -nv -w 5 192.0.2.10 22

curl -I https://example.com

Step 3 — Identify Service Versions

nmap -sV -p 22,80,443 192.0.2.10

Step 4 — Run Default NSE Scripts

nmap -sC -sV -p 22,80,443 192.0.2.10

Step 5 — Save Findings

nmap -sC -sV -p 22,80,443 -oN enumeration.txt 192.0.2.10

Service Enumeration and Banner Grabbing Cheat Sheet

Key takeaway: Port scanning identifies possible services. Banner grabbing collects service information. Version detection and NSE scripts help investigate services in more detail.