| Technique | Countermeasure | |-----------|----------------| | SYN scan | Enable SYN cookies, use IDS (Snort/Suricata) | | Connect scan | Monitor logs for multiple half-open connections | | UDP scan | Rate-limit ICMP port unreachable messages | | Version detection | Use port knocking or protocol obfuscation | | NSE scripts | Deploy Web Application Firewalls (WAF) | Scenario : Scan 192.168.56.101 (Metasploitable 2)

# Step 1 – Ping sweep nmap -sn 192.168.56.0/24 nmap -sS -p- 192.168.56.101 Step 3 – Version detection on interesting ports nmap -sV -p 21,22,80,445,3306 192.168.56.101 Step 4 – Vulnerability script scan nmap --script vuln -p 80 192.168.56.101