# Reconnaissance

The vulnerable machine IP address is **10.10.75.171.** So I use nmap on Kali Linux to start with basic reco&#x6E;**.**&#x20;

![1st Nmap scan](https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2Fmu10BhTD8IdgJEkNsIvK%2Frecon1.PNG?alt=media\&token=21050a9b-3cb4-46d6-bfdc-8086ec232864)

Initially I ran the scan with the verbose setting and specifying from ports 1-10000, this avoids nmap scanning all 65,000 ports. 3 open ports were discovered. 22 ssh, 111 rpcbind and 8983 unknown.&#x20;

Following the unknown port I realized I needed to run another scan, this time looking for service and versions (-sV)

![2nd Nmap scan](https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2Fo8vxdYbmfVplc9WJl8Lv%2Frecon2.PNG?alt=media\&token=ec0e9bd9-d0b2-4099-a73d-f0b97df07041)

Now I can see the service running on port 8983 is Apache Solr
