Unknown/Unlisted Ports
When to use: The general approach to follow when a known/documented vulnerability (like those in the categories above) can't be found among the ports scanned on a target.
Method logic: If you don't know a ready-made exploit for a port/service, match its version — detected via nmap's service version detection — against CVE databases; if a suitable script or exploit module exists, try it.
Steps
| Command | Description |
|---|---|
| nmap [target IP] -A -p- -T5 | Extracts all ports and service versions. |
| nmap [target IP] -p [port] -sV | When an unknown/suspicious port is found, re-targets that service to confirm the version. |
| - | Search the web for an exploit/script using the service name + version (e.g. "distccd 4.2.4 exploit", "[service name] [version] nmap script", "[service name] [version] CVE") — reliable sources: nmap.org, exploit-db.com, Rapid7/Metasploit module database. |
| locate [script name] or find / -iname "*[service name]*" 2>/dev/null | Confirm whether the script is actually installed on Kali and get its exact filename. |
| nmap -p [port] [target IP] --script [script name] --script-args="[script name].cmd='id'" | Runs the script; if none is found, search Metasploit instead with search [service name]. |
| - | The script/exploit runs a command directly on the target and prints the output (verifiable with commands like id, uname -a, ls) — these go into the cmd field. |
Real-World Example
See this methodology applied step by step against a real unlisted service — an outdated distcc daemon exploited via CVE-2004-2687.