Service banners
When you connect to a service with nc, it often introduces itself: name, version, sometimes much more. Scan archivio.nr, connect to every open port and read what each one has to say: one of them is out of the ordinary.
Lab 2 of 6 in the Recon & Scanning path. If you get stuck you have 3 hints, from the vaguest to the most precise: they cost 0, 40 and 100 XP.
What you learn
Objectives complete themselves while you work in the terminal; each one is worth experience points:
- Scan the ports of archivio.nr (60 XP)
- Read the FTP service banner (70 XP)
- Connect to the service on the unusual port (100 XP)
Topics: recon, banner, nc.
Commands you will use
The terminal is simulated and understands about forty Linux commands. In this lab you will mostly need these:
cat: prints the contents of a file: the most direct way to read configurations, notes and logs.nmap: discovers the live hosts of a network and the open ports of a machine, with services and versions. Defenders use it to compare the real network with the inventory.nc: netcat opens a raw connection to a port and shows what the service answers, including its greeting message (banner).
The simulated environment
The target is an invented host on a simulated private network: you can only reach it from the game terminal.
The target exposes these services:
- FTP: the old file transfer protocol that sends credentials and data in clear text; today it is replaced by SFTP.
- SSH: encrypted remote command-line access; it is protected with keys instead of passwords and without direct root login.
- SMTP: the mail server, whose greeting message can reveal internal names.
- Web (HTTP): a web server with pages, APIs or admin panels: the most exposed part of almost every organisation.
The defensive lesson
Once the lab is solved, the write-up explains what went wrong and how to protect yourself:
A banner is a service's business card: name, version and sometimes forgotten internal notes. It tells an attacker which known vulnerabilities to look for without sending a single suspicious packet. Defense: minimal banners (hide versions: ServerTokens Prod, DebianBanner no), no internal notes in welcome messages, switch off useless services and test agents — and keep patching, because hiding a version is no substitute for updates.
Before and after this lab
To unlock it you must have solved:
- Mapping a host (Recon & Scanning, easy)
After this lab you can move on to:
- Who's on the network? (Recon & Scanning, medium)
- Secrets in processes and local services (Privilege Escalation, medium)
- Closing the unneeded ports (Blue Team / Defense, medium)
The Recon & Scanning path
Recon & Scanning is reconnaissance: before defending a network, or testing it with permission, you need to know what is in it. You learn to discover live hosts, list ports and services, read the banners services greet you with, and query DNS and HTTP headers. Every lab also shows the defender’s point of view: an up-to-date asset inventory, minimal banners, internal DNS kept apart from public DNS and nothing forgotten left running.