9.1.3 Service Identification
← Reference index · Previous: TCP scanning · Next: UDP scanning | Strategy map | Study methods: Discover attack surfaces
Purpose: Identify applications on discovered ports and choose only the probing needed for the next decision.
9.1.3.1 Identify discovered applications
nmap -sT -n -sV -p PORTS -oA scans/tcp-services TARGET
Next: choose service-specific enumeration from application evidence. A version match alone does not establish exploitability.
9.1.3.1.1 Variants — default scripts, named scripts and OS fingerprints
9.1.3.1.2 Identify applications on discovered ports
Version probing plus the default NSE script set: use when those scripts answer relevant enumeration questions.
nmap -sT -n -sV -sC -p PORTS -oA scans/tcp-services-default TARGET
Read the application evidence and script results. Default scripts add interactions; they do not complete service enumeration or prove exploitability.
Lighter version probing when time or fragile service behavior matters:
nmap -sT -n -sV --version-light -p PORTS -oA scans/tcp-services-light TARGET
Light mode tries fewer uncommon probes and can miss an identity that the default intensity finds. Use the default first unless a concrete constraint justifies the tradeoff.
9.1.3.1.3 Select a named script
Inspect behavior locally:
nmap --script-help http-headers
After identifying HTTP, inspect its relevant port(s):
nmap -sT -n -p PORTS --script http-headers -oA scans/http-headers TARGET
Returned headers are clues. Choose scripts for the question they answer and their behavior.
9.1.3.1.4 OS fingerprinting and bundled probing
Estimate OS from network-stack behavior:
sudo nmap -n -O -oA scans/os TARGET
Request more tentative OS guesses:
sudo nmap -n -O --osscan-guess -oA scans/os-guesses TARGET
Bundle OS/version detection, default scripts and traceroute:
sudo nmap -sS -n -A -oA scans/combined-detail TARGET
OS guesses are hypotheses. These use default TCP coverage; -A does not mean all ports. Choose this bundle only when its additional probing is useful.