Scanning and enumeration in Cybersecurity - Mini Project: Build & Apply

Understanding Scanning and Enumeration in Cybersecurity

📖 Scenario: You are a cybersecurity analyst tasked with identifying active devices and services on a small company network. This helps protect the network by knowing what is connected and what might be vulnerable.

🎯 Goal: Build a simple step-by-step understanding of scanning and enumeration by creating a list of devices, setting a scanning range, identifying active devices, and listing their open services.

📋 What You'll Learn

Create a list of devices with their IP addresses and status

Set a scanning range variable to define which IPs to check

Use a loop to find active devices within the scanning range

List open services for each active device

💡 Why This Matters

🌍 Real World

Network administrators use scanning and enumeration to discover devices and services on their networks to maintain security and manage resources.

💼 Career

Understanding scanning and enumeration is essential for cybersecurity roles such as penetration testers, network security analysts, and system administrators.

1

Create the initial list of devices

Create a list called devices containing dictionaries for these devices exactly: {'ip': '192.168.1.2', 'status': 'inactive'}, {'ip': '192.168.1.3', 'status': 'active'}, and {'ip': '192.168.1.4', 'status': 'inactive'}.

Cybersecurity

# Create the list of devices with IP and status
# Your code here

Hint

Use a list with dictionaries. Each dictionary should have keys 'ip' and 'status' with the exact values given.

2

Set the scanning IP range

Create a variable called scan_range and set it to a list containing these IP addresses exactly: '192.168.1.2', '192.168.1.3', '192.168.1.4'.

Cybersecurity

devices = [
    {'ip': '192.168.1.2', 'status': 'inactive'},
    {'ip': '192.168.1.3', 'status': 'active'},
    {'ip': '192.168.1.4', 'status': 'inactive'}
]
# Create the scan_range list with the given IPs
# Your code here

Hint

Use a list with the exact IP addresses as strings.

3

Identify active devices in the scan range

Create a list called active_devices that contains the IP addresses from devices where the status is 'active' and the ip is in scan_range. Use a for loop with variables device to check each device.

Cybersecurity

devices = [
    {'ip': '192.168.1.2', 'status': 'inactive'},
    {'ip': '192.168.1.3', 'status': 'active'},
    {'ip': '192.168.1.4', 'status': 'inactive'}
]

scan_range = ['192.168.1.2', '192.168.1.3', '192.168.1.4']

# Create active_devices list with IPs of active devices in scan_range
# Your code here

Hint

Use a for loop to check each device's status and IP, then add the IP to active_devices if conditions match.

4

List open services for each active device

Create a dictionary called services where keys are IP addresses from active_devices and values are lists of open services. Add these exact entries: '192.168.1.3': ['HTTP', 'SSH'].

Cybersecurity

devices = [
    {'ip': '192.168.1.2', 'status': 'inactive'},
    {'ip': '192.168.1.3', 'status': 'active'},
    {'ip': '192.168.1.4', 'status': 'inactive'}
]

scan_range = ['192.168.1.2', '192.168.1.3', '192.168.1.4']

active_devices = []
for device in devices:
    if device['status'] == 'active' and device['ip'] in scan_range:
        active_devices.append(device['ip'])

# Create services dictionary with open services for active devices
# Your code here

Hint

Create a dictionary with the IP as key and a list of services as value exactly as shown.

Practice

1. What is the main purpose of scanning in cybersecurity?

easy

A. To find active devices and open ports on a network

B. To collect detailed user account information

C. To encrypt data during transmission

D. To block unauthorized access automatically

Solution

1. Step 1: Understand scanning basics

   Scanning is used to detect which devices are active and which ports are open on a network.

2. Step 2: Differentiate from enumeration

   Enumeration goes deeper to gather detailed info, but scanning is about discovery.

3. Final Answer:

   To find active devices and open ports on a network -> Option A

4. Quick Check:

   Scanning = Finding devices and ports [OK]

Hint: Scanning finds devices and ports first, enumeration follows [OK]

Common Mistakes:

• Confusing scanning with enumeration
• Thinking scanning encrypts data
• Assuming scanning blocks access

2. Which of the following is the correct syntax to run a basic port scan using the Nmap tool?

easy

A. nmap scan 192.168.1.1 -open

B. nmap -sS 192.168.1.1

C. scan -nmap 192.168.1.1

D. nmap --list-ports 192.168.1.1

Solution

1. Step 1: Identify correct Nmap command format

   The correct Nmap syntax for a TCP SYN scan is nmap -sS [target].

2. Step 2: Check options for errors

   Options like 'scan' or '--list-ports' are incorrect or invalid in this context.

3. Final Answer:

   nmap -sS 192.168.1.1 -> Option B

4. Quick Check:

   Nmap SYN scan = nmap -sS [IP] [OK]

Hint: Nmap SYN scan uses -sS flag before target IP [OK]

Common Mistakes:

• Using invalid flags like --list-ports
• Placing options after IP incorrectly
• Confusing scan command syntax

3. Consider this Nmap output snippet:

PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
443/tcp  closed https

What does this output tell you about port 443?

medium

A. Port 443 is closed and not accepting connections

B. Port 443 is filtered by a firewall

C. Port 443 is open and accepting connections

D. Port 443 is in an unknown state

Solution

1. Step 1: Read port state from output

   The output shows port 443/tcp as 'closed', meaning it is not open for connections.

2. Step 2: Understand port states

   'Closed' means the port is reachable but no service is listening; 'filtered' would mean blocked by firewall.

3. Final Answer:

   Port 443 is closed and not accepting connections -> Option A

4. Quick Check:

   Port 443 state = closed means no connection [OK]

Hint: Closed port means reachable but no service listening [OK]

Common Mistakes:

• Confusing closed with filtered
• Assuming closed means open
• Ignoring port state labels

4. You run an enumeration command but get no detailed user info. Which of these is the most likely cause?

medium

A. The target device is offline

B. The network cable is unplugged

C. You used scanning instead of enumeration

D. The enumeration tool lacks proper permissions

Solution

1. Step 1: Analyze why enumeration fails

   Enumeration requires permissions to access detailed info; without them, it returns nothing.

2. Step 2: Eliminate other options

   If the device was offline or cable unplugged, scanning would fail too; scanning vs enumeration is about info depth, not success.

3. Final Answer:

   The enumeration tool lacks proper permissions -> Option D

4. Quick Check:

   Permissions needed for enumeration details [OK]

Hint: No info? Check permissions for enumeration tool [OK]

Common Mistakes:

• Confusing scanning failure with enumeration failure
• Ignoring permission requirements
• Assuming device offline without checking

5. You want to create a report listing all active devices and their open ports on a network, then gather usernames from those devices. Which sequence of actions is best?

hard

A. Run enumeration first, then scanning

B. Only run enumeration since it finds devices and usernames

C. Run scanning to find devices and ports, then enumeration for usernames

D. Only run scanning since it finds all info needed

Solution

1. Step 1: Understand scanning and enumeration roles

   Scanning finds active devices and open ports; enumeration collects detailed info like usernames.

2. Step 2: Determine correct order

   You must scan first to identify targets, then enumerate those targets for detailed info.

3. Final Answer:

   Run scanning to find devices and ports, then enumeration for usernames -> Option C

4. Quick Check:

   Scan first, then enumerate details [OK]

Hint: Scan to find devices, enumerate for details next [OK]

Common Mistakes:

• Reversing scanning and enumeration order
• Assuming scanning finds usernames
• Skipping scanning step