Running a service version scan is very simple; all we need to do is add an additional flag, -sV. This means that we're conducting a service version scan, which can demonstrate which version of each software is running. This is particularly useful if someone is running a service on a non-default port (that does not match up with /etc/services)—in such instances, it's even more important to be able to figure out exactly what's running.

When we run this follow-up scan, you will see that the results are slightly different:

You can see in the preceding screenshot that significantly more information is now being put into the scan results; in this case, we can see the actual patch versions of the OpenSSH, HTTP, and Nping echo services.

In the context of a security assessment, you can see how useful this would be! If you are looking for vulnerabilities in certain versions of software, it's critical to be able to tell exactly what version is running. Vulnerabilities are often only...