Survey a small set of common TCP ports
What you are learning
Use the trainer's authorized action to check a small fixed set of TCP ports on the assigned lab target. OPEN means a service accepted a connection. CLOSED usually means the host was reachable but nothing was listening on that port. A port result does not prove a vulnerability. Record the result as an observation and use the lesson context before deciding what it means.
- Perform a constrained survey of common TCP ports against an explicitly authorized target.
- Identify which tested ports are open and distinguish observed exposure from assumptions about the underlying software.
- Translate validated observations into concise, evidence-based findings.
- Describe how defenders could observe and investigate the scan pattern.
Knowing which ports are reachable helps defenders manage exposed services, check firewall rules, and keep asset records current. Unexpected open ports may show configuration drift or unnecessary exposure. In real environments, the same kind of traffic may come from legitimate troubleshooting, asset discovery, monitoring, or security testing. Defenders therefore compare the pattern with approved work before deciding that the activity is suspicious.
Use a repeatable web-testing method
Connect this ATT&CK training activity to the WSTG approach: establish expected behavior, identify the relevant attack surface, change one controlled input or observation at a time, compare the response with the baseline, and record evidence before drawing a conclusion.
For reconnaissance-oriented lessons such as T1595, treat reachability, exposed services, and observable application behavior as information gathering. A reachable service is evidence about exposure; it is not by itself proof of a vulnerability.
Open WSTG web security fundamentalsUse only the trainer-provided small-port survey against the configured lab target. Record the ports reported as open. Do not call a result a vulnerability unless the exercise provides evidence for that claim. Also name one defender data source that could show the connection pattern.
Authorized reconnaissance action
Commands, flags, ports, and targets are fixed by the trainer. The participant cannot enter arbitrary shell commands.
Enter one finding per line. Identity and condition are locked by the facilitator.
Use these examples as a structure only. Replace the angle-bracket placeholders with what you actually observe in the trainer output. Do not copy an example as a finding.
TCP <port> <state> TCP <port> <state> — <brief observation if useful>
How to interpret port state: OPEN means a service accepted a connection on that port from the scanner's current network position. CLOSED means the host was reachable and actively rejected or reset the connection because no service was listening on that port at that moment. FILTERED means the scanner could not determine whether the port was open because a firewall, security group, packet filter, or other network control may have blocked or dropped the probe. Port state describes observed connectivity; none of these states by itself proves a vulnerability.
Port state describes connectivity, not vulnerability. OPEN, CLOSED, and FILTERED results need context. Defenders should interpret this result with other evidence and context before deciding what it means.
A series of connection attempts across several ports can appear in firewall, flow, IDS/IPS, endpoint, proxy, or service logs. Compare exposed ports with the approved asset inventory and firewall policy. Reduce risk by closing unnecessary ports, restricting management services, and using network segmentation. Defenders should compare the source, timing, rate, and destination pattern with approved administration, monitoring, and vulnerability-management work. This comparison helps separate normal activity from scanning that needs review.