ZeroDay Labs, Cyber Range
Dashboard
Tracks
Admin
Edit lab
Editing nmap-host-discovery
{ "slug": "nmap-host-discovery", "tags": [ "nmap", "interactive", "guided-lab" ], "flags": [ { "key": "final", "value": "ZDL{discover-hosts-before-deep-scans}" } ], "hints": [ { "id": "hint-1", "content": "Use nmap -sn first. That tells you who is up without doing a full port scan.", "penaltyPoints": 0 }, { "id": "hint-2", "content": "After you know the live IPs, scan each host individually. One of them has 80/tcp open and the other does not.", "penaltyPoints": 5 } ], "title": "Host Discovery Basics", "runtime": { "mode": "docker_compose", "cpuLimit": 1, "exposePorts": [ 8080 ], "templateKey": "nmap-target-range", "memoryLimitMb": 512, "artifactsMountPath": "/lab/artifacts" }, "summary": "Learn the difference between finding live hosts and enumerating their services, then apply both steps in a tiny lab range.", "scenario": "You have a small internal range and almost no context. Before you burn time on deeper enumeration, you need to answer the first analyst question: which hosts are actually alive, and which one is worth immediate follow-up because it exposes a web service?", "artifacts": [ { "key": "workbench", "path": "artifacts/index.html", "type": "text_blob", "label": "Browser workbench", "downloadable": true }, { "key": "notes", "path": "artifacts/nmap-host-discovery.txt", "type": "text_blob", "label": "Lab notes", "downloadable": true } ], "questions": [ { "key": "q1", "type": "short_text", "answer": "2", "points": 10, "prompt": "How many live hosts did the host-discovery scan find?", "caseSensitive": false }, { "key": "q2", "type": "short_text", "answer": "172.28.0.2", "points": 10, "prompt": "Which host exposes HTTP on port 80?", "caseSensitive": false }, { "key": "q3", "type": "short_text", "answer": "172.28.0.3", "points": 10, "prompt": "Which live host is up but shows no open TCP ports in the default scan?", "caseSensitive": false }, { "key": "flag-final", "type": "flag", "answer": "ZDL{discover-hosts-before-deep-scans}", "points": 20, "prompt": "Submit the final lab flag.", "caseSensitive": true } ], "trackSlug": "nmap-fundamentals", "difficulty": "beginner", "trackTitle": "Nmap Fundamentals", "instructions": [ { "id": "step-1", "title": "Use the guided runtime", "content": "The runtime provides a browser-based Nmap command simulator for the exact commands this lesson is teaching." }, { "id": "step-2", "title": "Find live hosts first", "content": "Run a host-discovery command against the small range and note which IPs answer probes." }, { "id": "step-3", "title": "Follow up on the live systems", "content": "Run a default scan against each live IP and determine which one exposes HTTP on port 80." } ], "estimatedMinutes": 25, "timeLimitMinutes": 40, "learningObjectives": [ "Use host discovery to answer who is alive before scanning every port everywhere.", "Interpret simple Nmap output and separate host reachability from service exposure.", "Translate scan results into a short, useful analyst finding." ], "dbLabId": "2a9c6196-d830-49ff-b1cc-0bd1ad7bb629" }