Service & Version Detection
What is it?
Version detection probes an open port and reads the service's response to identify the product and version (e.g. 'OpenSSH 7.2', 'Apache 2.4.29'). It turns 'port 22 open' into 'this exact SSH build'.
Why it matters
The version is what makes a finding actionable: an outdated or unexpected build is a vulnerability lead, and a service on the wrong port revealed by its banner is a misconfig or a backdoor.
Where you see it
Rows gain detail: '22/tcp open ssh OpenSSH 7.2p2', '8081/tcp open http (nginx 1.10)' — the banner names the software.
What normal looks like
Current, patched versions of the services a host is supposed to run, on their expected ports.
What suspicious looks like
A years-old version with known CVEs, a service that should not be exposed at all, or a banner that does not match the port (a shell on 8081).
How analysts investigate
Read the product+version, compare against the patch baseline and known-vulnerable versions, and question any banner that does not fit the port's expected role.
Common beginner mistakes
- Trusting the banner blindly — banners can be changed; corroborate before acting.
- Ignoring the version and treating all open ports as equal risk.
From 'open' to 'exactly what and how old'
22/tcp open ssh OpenSSH 7.2p2 ← years old → CVE lead
443/tcp open https nginx 1.25 ← current → lower priority
8081/tcp open http (unrecognized banner: /bin/sh?) ← does NOT fit the port
the version + the fit decide priority, not the open state aloneQuick check
Which open port is the highest-priority finding?
A quick self-check — it doesn't affect your XP or progress.
Sign in to save your progress on the server.