JFR Sec
--:--:--
Back to catalog
Network SecurityCVSS 6.8 · High

NetHardener – Perimeter Recon & OSI Network Audit

Stealth Nmap sweep and service fingerprinting across a simulated small-business perimeter to enumerate the full external attack surface.

2025-09-142 days
NmapNetwork AuditReconService Enumeration
[ VIEW REPO]
Executive Summary

A lab environment modeling a small-business perimeter was swept end-to-end using staged Nmap scans — host discovery, stealth SYN scanning, and full service/version fingerprinting — to build an accurate picture of the externally reachable attack surface. Detected service versions were cross-referenced against known CVEs. The sweep found a database service bound to all interfaces and reachable from the internet, plus an outdated SSH daemon vulnerable to user enumeration, both prioritized for immediate remediation ahead of lower-severity banner-disclosure issues.

Scope
  • 10.10.10.0/24 perimeter lab segment
  • Single externally-facing host (10.10.10.15)
Overview

A full TCP/UDP sweep catalogued live hosts, open ports, and running services, then cross-referenced fingerprinted versions against known CVEs to produce a prioritized hardening checklist.

Objectives
  • Discover all live hosts on the target CIDR
  • Fingerprint services and versions on open ports without tripping alerting
  • Cross-reference versions against known CVEs
  • Document a prioritized hardening checklist
Methodology
  1. 1ICMP/ARP host discovery sweep across the CIDR
  2. 2Stealth SYN scan with timing throttled to evade basic IDS thresholds
  3. 3Service and version detection with default NSE scripts
  4. 4UDP top-ports sweep for commonly missed exposure
  5. 5CVE cross-reference against fingerprinted service versions
Command Log
session_log.sh

# Host discovery sweep

$ nmap -sn 10.10.10.0/24 -oG live_hosts.txt

Host: 10.10.10.1
Host: 10.10.10.15
Host: 10.10.10.22
3 hosts up.

# Stealth SYN scan, full port range, throttled timing

$ nmap -sS -p- -T2 -D RND:6 -oA full_tcp 10.10.10.15

PORT      STATE SERVICE
22/tcp    open  ssh
80/tcp    open  http
443/tcp   open  https
3306/tcp  open  mysql

# Service/version detection + default scripts

$ nmap -sV -sC -p22,80,443,3306 -oA svc_scan 10.10.10.15

22/tcp   open  ssh     OpenSSH 7.2 (protocol 2.0)
80/tcp   open  http    Apache httpd 2.4.18 ((Ubuntu))
443/tcp  open  ssl/http Apache httpd 2.4.18
3306/tcp open  mysql   MySQL 5.5.62-0ubuntu0.14.04.1

# UDP top-100 sweep

$ nmap -sU --top-ports 100 -oA udp_scan 10.10.10.15

68/udp  open|filtered dhcpc
123/udp open          ntp
Findings

Outdated OpenSSH exposed to the internet

OpenSSH 7.2 is vulnerable to username enumeration via timing side-channel (CVE-2018-15473).

Medium

MySQL bound to 0.0.0.0

Database service reachable externally on 3306/tcp with weak default credentials accepted on first attempt.

Critical

Verbose HTTP server banner

Apache banner disclosed exact version and OS build, simplifying exploit targeting for an attacker.

Low
Remediation
  • Patch OpenSSH to the latest stable release
  • Bind MySQL to localhost or an internal-only interface; enforce strong credentials
  • Disable server tokens and verbose banners on all public-facing services