Introduction
In network security and system administration, knowing that a port is open is only half the battle. By default, port scanners guess the running service based on standard port numbers (for example, assuming port 80 is always an HTTP web server). However, administrators can run any service on any port.
This is why banner and version detection matter. Port numbers are hints, not proof. Real environments frequently use custom ports, reverse proxies, container frontends, or misleading service names.
To accurately identify what is truly running on a target system, you need to interrogate the open ports. In this lab, you will explore Nmap's version detection capabilities. You will learn how to grab service banners and accurately identify the exact software names and version numbers, which is a critical step in vulnerability assessment.
Enable Version Detection
In this step, you will learn the basics of Nmap's version detection. By default, Nmap only tells you if a port is open and what service typically runs on that port based on a static lookup table. To find out exactly what software is listening, you need to actively interrogate the service.
You can enable version detection by adding the -sV flag to your Nmap command. This tells Nmap to send a series of specific probes to the open ports and analyze the responses to determine the service and its version.
In other words, Nmap stops inferring from the port number alone and starts interrogating the application behavior directly.
Run the following command in your terminal to scan your local machine and detect the versions of the running services:
nmap -sV -p 80,8080 localhost
You will see an output similar to this:
Starting Nmap 7.80 ( https://nmap.org )
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000010s latency).
PORT STATE SERVICE VERSION
80/tcp open http nginx 1.18.0 (Ubuntu)
8080/tcp open http SimpleHTTPServer 0.6 (Python 3.10.12)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.51 seconds
Notice the VERSION column in the output. Instead of just guessing that port 80 is HTTP, Nmap actively communicated with the port and discovered it is running Nginx version 1.18.0. It also successfully identified a Python HTTP server running on port 8080.
Adjust Version Intensity
In this step, you will learn how to control the aggressiveness of Nmap's version detection. Nmap uses a scale from 0 to 9 to determine how many probes to send to a target service.
The default intensity is 7. A higher intensity means Nmap will try more probes, which increases the chances of correctly identifying the service but takes more time. A lower intensity is faster but might fail to identify obscure services. You can adjust this using the --version-intensity flag followed by a number between 0 and 9.
This is another speed-versus-certainty tradeoff. The more uncertain or unusual the target looks, the more valuable deeper probing becomes.
Let us try a highly aggressive scan by setting the intensity to 9. This forces Nmap to try every single probe in its database against the open ports. Run the following command:
nmap -sV -p 80,8080 --version-intensity 9 localhost
The output will look similar to the previous step, but behind the scenes, Nmap was much more thorough in its interrogation:
Starting Nmap 7.80 ( https://nmap.org )
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000012s latency).
PORT STATE SERVICE VERSION
80/tcp open http nginx 1.18.0 (Ubuntu)
8080/tcp open http SimpleHTTPServer 0.6 (Python 3.10.12)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
You can also use the --version-light flag as a shortcut for intensity 2, or --version-all as a shortcut for intensity 9. These shortcuts make it easier to quickly adjust the scan behavior without remembering the exact numbers.
Identify Software Exact Version
In this step, you will focus on identifying the exact software version of a specific service and saving the results for documentation. When performing security assessments, keeping a record of the exact software versions is crucial for finding known vulnerabilities.
Instead of scanning all ports, you can target a specific port using the -p flag and save the output to a file using the -oN flag. This is very useful when you want to isolate a specific service and share the findings with your team.
Run the following command to scan only port 80, detect its version, and save the output to a file named version_scan.txt in your current directory:
nmap -sV -p 80 localhost -oN version_scan.txt
After the scan completes, you can view the contents of the saved file using the cat command:
cat version_scan.txt
Your output should display the exact version of the Nginx server running on port 80:
## Nmap 7.80 scan initiated ...
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000015s latency).
PORT STATE SERVICE VERSION
80/tcp open http nginx 1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
## Nmap done at ...
By documenting the exact version, such as nginx 1.18.0, you can now search vulnerability databases to see if this specific version has any known security flaws.
Summary
In this lab, you explored Nmap's powerful version detection capabilities. You learned how to use the -sV flag to move beyond simple port scanning and actively interrogate services to discover their exact software names and versions. You also learned how to adjust the scan intensity using --version-intensity to balance speed and accuracy, and how to target specific ports and save the results for vulnerability analysis. These skills are essential for accurate network mapping and security auditing.
