TryHackMe — Blue | Phase 1: Reconnaissance with Nmap

Course: Cyber Security 101 | Room: Blue | Tool: Nmap

Context

The Blue room's main objective is the use of Metasploit. However, the first exercise focuses on reconnaissance — identifying open ports and vulnerabilities on the target before any exploitation.

Command used

nmap -sV -vv --script vuln <IP>

Discovered ports

Identified vulnerability

smb-vuln-ms17-010: VULNERABLE
CVE: CVE-2017-0143
Risk factor: HIGH
Disclosure date: 2017-03-14

The NSE script smb-vuln-ms17-010 confirmed that SMBv1 is active and vulnerable to EternalBlue — the same flaw used by the WannaCry ransomware in 2017.

Blue Team Perspective

This reconnaissance step is also a valuable exercise for those working in defense. What Nmap reveals about the target is exactly what a Blue Team analyst should proactively identify on their own network.

What this scan indicates for the defensive team:

Central question: if an attacker can obtain this information in seconds with Nmap, does the defense team already have visibility over this attack surface?

Reconnaissance is not just an offensive step — it is a mirror of what the Blue Team should be seeing first.

Room completed in May 2026 — TryHackMe Cyber Security 101