What your child will learn
Explain why nmap SYN scans against a target you do not own are unauthorized access under CFAA even if you do not exploit any finding
Run an nmap service-version scan against a Docker lab container on your own laptop and identify the listening services and their versions
Map a service-version result to a CVE class — describe how a 2017 OpenSSH version banner ties to specific CVEs and the risk they represent
Document every active probe in an engagement log with timestamp / target / probe type / result — this is the audit trail professional pentesters maintain
How this mission works
In Scanning 201 you move from passive to active — but ONLY against a sandboxed lab target you own. Enumerate open TCP ports, banner-grab the listening services, and map the attack surface. The frame: every active probe leaves a fingerprint in the target's logs and IDS, and an out-of-scope scan is "unauthorized access" under CFAA even if you never exploit anything. You learn the ETHICAL workflow: scan only against (a) systems you personally own, (b) explicitly-authorized engagement targets in a written RoE, or (c) sandboxed lab assets.
What students actually encounter
You scan a public IP that does not belong to you and find port 22 open. You are NOT under a written RoE — what is the right action?
An nmap service-version scan returns "Apache httpd 2.4.49" — why does the version banner matter?
Which scan technique sends packets to the target but never completes the TCP handshake?
Cipher is with them the whole way
When a student gets stuck on Pen-Test Scanning 201 — Enumeration & Service Detection, Cipher appears with a mission-specific nudge — no spoilers, just a hint toward the right thinking. Make a wrong choice, and Cipher explains the real-world consequence. Finish the mission, and Cipher generates a personalized performance debrief based on exactly how the student played it.
ISTE alignment
Scan strictly on owned / RoE-authorized targets. The mission teaches the version-banner-to-CVE bridge as the next step in the senior-pentester flow. APIE alignment: (A) Apply attack-surface enumeration to owned lab targets only, (P) Practice banner mapping without exploitation, (I) Interpret version-to-CWE relationships, (E) Evaluate engagement-log audit trails. Aligned to NICE-SU-PEN-01 ("conduct full-scope authorized penetration tests").