Identify service versions
What you are learning
Use the trainer's authorized service-identification action on the assigned lab target. The result may show which service or protocol is listening on an open port and may report a version. Treat the result as a clue, not proof of the exact software build, patch level, vulnerability, or exploitability.
- Identify services associated with exposed TCP ports on an authorized target.
- Distinguish a general service type from a specific implementation or version.
- Record service-identification evidence without overstating conclusions.
- Explain how defenders can validate service and version observations before prioritizing remediation.
Service information can help with asset review, patching, and exposure management. Defenders should confirm scanner results with trusted inventory or system records before making important decisions. In real environments, the same kind of traffic may come from legitimate troubleshooting, asset discovery, monitoring, or security testing. Defenders therefore compare the pattern with approved work before deciding that the activity is suspicious.
Use a repeatable web-testing method
Connect this ATT&CK training activity to the WSTG approach: establish expected behavior, identify the relevant attack surface, change one controlled input or observation at a time, compare the response with the baseline, and record evidence before drawing a conclusion.
For reconnaissance-oriented lessons such as T1595, treat reachability, exposed services, and observable application behavior as information gathering. A reachable service is evidence about exposure; it is not by itself proof of a vulnerability.
Open WSTG web security fundamentalsReview the command and flag explanations shown below. Then run only the trainer-provided service-identification action against the configured lab target. Read the PORT, STATE, SERVICE, and VERSION columns. Record only what Nmap reports. If a version is blank or generic, do not invent one. Do not test any other address.
What the command is doing
This lesson uses Nmap service/version detection on the trainer's fixed TCP ports. The command uses -Pn so Nmap does not depend on ICMP reachability first, -sV to perform service/version detection, and -p 22,80 to restrict the scan to the trainer-approved port set. The trainer supplies the authorized lab target.
Finding the service and version
How service/version identification works: Nmap's -sV option connects to an open service and sends lightweight protocol-specific probes. It then compares the responses with its service-probe database to estimate the service name and, when the response exposes enough detail, a product and version string. Read the Nmap result row from left to right: PORT identifies the tested port and protocol, STATE describes connectivity, SERVICE is Nmap's service classification, and VERSION contains the product/version clue when Nmap can infer one. If VERSION is blank or generic, do not invent a version. Record only what the output actually shows.
Command used in this lesson
The command that will be run:
nmap -Pn -sV -p 22,80 <authorized-target>
What each part means
nmap— Runs Nmap, the network discovery and service-identification tool used by this controlled exercise.-Pn— Skips Nmap host discovery and treats the authorized target as online. This avoids depending on ICMP/ping replies, which may be filtered.-sV— Enables service/version detection. Nmap sends lightweight probes to open services and uses the responses to estimate the service name and, when possible, a product/version string.-p 22,80— Restricts the scan to TCP ports 22 and 80. The trainer intentionally limits the exercise to this small approved port set.<authorized-target>— A placeholder for the participant facilitator-authorized lab target. The trainer substitutes this value automatically; the participant cannot edit it.
How to read the Nmap result
- PORT: the tested port number and protocol.
- STATE: whether Nmap observed the port as open, closed, filtered, or another state.
- SERVICE: Nmap classification of the service associated with the port.
- VERSION: the product/version clue Nmap inferred from the response. If this is blank or generic, do not guess a version.
Authorized reconnaissance action
Commands, flags, ports, and targets are fixed by the trainer. The participant cannot enter arbitrary shell commands.
Enter one finding per line. Identity and condition are locked by the facilitator.
Replace the placeholders with the values shown by Nmap. If the VERSION column does not contain a specific version, omit it rather than guessing.
TCP <port> <state> — <service> TCP <port> <state> — <service> <version if Nmap shows one>
Service and version strings are useful clues, but they should be verified before making a vulnerability claim. Defenders should interpret this result with other evidence and context before deciding what it means.
Service-detection probes may appear as repeated connections or unusual requests in firewall, IDS/IPS, proxy, service, or host logs. Confirm the asset owner, expected service, installed version, patch status, and whether the scan was approved. Reduce risk with accurate inventory, timely patching, fewer exposed services, and monitoring. Defenders should compare the source, timing, rate, and destination pattern with approved administration, monitoring, and vulnerability-management work. This comparison helps separate normal activity from scanning that needs review.