Network Service Discovery

This guide treats network service discovery as a control boundary rather than a list of attack commands. First document who owns it, who should reach it, what identity context applies, and which data or downstream systems it can affect.

• Confirmed asset owner and in-scope address or application.
• Expected clients, identities, and network zones.
• Protocol versions, encryption expectations, and authentication mode.
• Sensitive data classes and downstream dependencies.
• Monitoring owner, escalation contact, and agreed stop threshold.

1. 01

   Start from the approved host list and remove broadcast, shared, or third-party ranges.

2. 02

   Confirm routing and source IP visibility with the operations team.

3. 03

   Scan a narrow expected port set at low rate before expanding.

4. 04

   Correlate protocol, certificate, banner, and application evidence instead of trusting a port number.

nmap -sV -T2 --max-rate 20 \
+  -p 22,25,53,80,110,143,443,445,587,993,995 \
+  192.0.2.10 -oA approved-baseline

A useful result demonstrates a broken security expectation with a reversible, low-impact test. Scanner labels and version matches are leads; validate the actual control and preserve the clean baseline beside the changed request.

1. 01

   Manually confirm each high-value service with a protocol-appropriate read-only request.

2. 02

   Record whether the service is expected, owned, supported, and externally reachable by design.

3. 03

   Compare duplicate frontends using TLS names, redirects, and response signatures.

4. 04

   Stop on unstable hosts or unexpected operational impact.

ASSET / ENDPOINT:
SCOPE REFERENCE:
IDENTITY / NETWORK ZONE:
BASELINE:
CONTROL TESTED:
EXPECTED RESULT:
OBSERVED RESULT:
TIMESTAMP / REQUEST ID:
SANITIZED EVIDENCE:
STOP / CLEANUP STATUS:

• Capture scan source, rate, timing, target set, and tool version.
• Verify that network telemetry records the approved discovery activity.
• Flag new services, unexpected management planes, and assets missing from inventory.

Keep raw data only when it is necessary to reproduce the finding. Redact credentials, session values, customer content, internal addresses, and personal data before evidence enters a ticket or report.

• Close unnecessary listeners and management ports.
• Restrict reachability by network zone and identity.
• Remove verbose banners and unsupported protocol versions.
• Continuously reconcile observed services with the authoritative inventory.