TD Cyber Labs

BackCyber Labs / Network Recon with Nmap Simulated 0 / 90 pts

Network Recon with Nmap

A single target sits on the lab network. Map its services, recover a weak credential, get a shell and read the flag — all in a browser Kali shell.

Available tools: nmap · hydra · ssh · curl · nc · ping · sudo · find · grep
Target: shop.lab (10.10.10.20)

✓

Which TCP ports are open? (comma-separated)

10 pts

Scan the target with nmap first, then read the port list off the output.

✓

What version of OpenSSH is the target running?

10 pts

A plain scan will not show versions. Add -sV.

✓

What is the password for the user 'dev'?

20 pts

Recover it with a password attack before answering.

✓

Get an interactive SSH shell on the target as 'dev'

10 ptsDone in the terminal

✓

Submit the user flag

40 pts

You need a shell on the target before you can read the flag.

Applications

target 10.10.10.20--:--

learner@kali: ~ — Terminal