Payment by bank transfer · Moroccoتعلَّم · مارِس · أتقِن

Catalogue / Cybersecurity

Inventorying and Auditing Your Own Network with Nmap

The administrator's point of view: inventory the exposed services of your own machines with Nmap, spot the ports to close, fix them, prove the fix with a new scan and write an authorized internal audit report.

  • Beginner to intermediate
  • 9 lessons
  • 7 h 30 min

A MasterLinux course · Original text

What you will learn

  • Scope an internal audit - perimeter, written authorization, time window and action log
  • Know the Moroccan legal framework (Penal Code, articles 607-3 onwards) and scan only what you own
  • Understand TCP, UDP and Nmap's six port states
  • Inventory the open ports of a machine with -sT, -p, -p- and --top-ports
  • Identify services and their versions with -sV to spot outdated software
  • Produce usable output (normal, XML, grepable) and analyze it with grep and xmllint
  • Safely use NSE scripts from the safe and default categories
  • Fix issues - stop an unneeded service, restrict listening to 127.0.0.1, filter with the firewall
  • Prove each fix with a new scan and track changes over time with ndiff
  • Write a clear audit report - findings, risks, fixes, verification

Course content

9 lessons · 7 h 30 min
Section 1 — Framework and fundamentals3 lessons · 2 h
  1. Scope, authorization and method of an internal audit Preview35 min
  2. TCP and UDP refresher, and Nmap port states 40 min
  3. First inventory of your machine: -sT, -p and --top-ports 45 min
Section 2 — Detailed inventory and remediation4 lessons · 3 h 15 min
  1. Identifying services and their versions with -sV 45 min
  2. Usable output: -oN, -oX, -oG, -oA and analysis with grep and xmllint 50 min
  3. Safe NSE scripts: banner, http-title, http-server-header, ssh-hostkey 45 min
  4. Fix what you found, then verify with a new scan 55 min
Section 3 — Tracking and project2 lessons · 2 h 15 min
  1. Tracking changes in an inventory with ndiff 45 min
  2. Project: full audit of your VM with a report 1 h 30 min

Requirements

  • The “Fundamentals” course (included) or solid hands-on experience with the Linux command line
  • Basic networking concepts (IP address, port, TCP); the “Networks and VPN” course is a plus
  • A Debian or Ubuntu virtual machine of your own for the labs

Who is this course for?

  • Junior network technicians and administrators who want to know what their servers expose
  • IT managers of small businesses, hospitals, schools or universities preparing an internal audit
  • Students heading for defensive cybersecurity (SOC, compliance, hardening)