Banner Grabbing Tools and Examples for Ethical Hacking on Kali Linux

Banner grabbing is one of the fastest ways to learn what software a host runs before you search for exploits. You connect to an open port (or request a web URL) and read the greeting line or HTTP headers the service returns. That text often includes the product name and version, which you later match against CVE records or Metasploit modules.

This guide walks through six tools on Kali Linux against a Metasploitable 2 lab target. Every command and output block below was captured on that layout.

What is banner grabbing in ethical hacking?

When a client opens a TCP connection, many services send a one-line greeting before authentication. Examples:

• SSH — SSH-2.0-OpenSSH_4.7p1 Debian-8ubuntu1
• FTP — 220 (vsFTPd 2.3.4)
• HTTP — Server: Apache/2.2.8 (Ubuntu) DAV/2

Penetration testers call that response a banner. Reading it is banner grabbing: low-effort recon that feeds the rest of your workflow (module search, CVE lookup, targeted exploits). It is not exploitation by itself.

Active banner grabbing means your tools connect directly to the target IP or URL (nmap, nc, curl on your lab target). That traffic may be logged by IDS. Passive methods query third-party scan databases (Shodan, Censys) without your IP touching the target during collection. This article focuses on active banner grabbing in a local lab.

Kali lab setup

Before you run the examples:

• Kali Linux with the tools below installed
• Metasploitable 2 on the same host-only or internal network as Kali
• Basic terminal comfort (cd, piping, reading port numbers)

Install the packages if they are missing on your Kali image:

sudo apt update
sudo apt install -y nmap netcat-openbsd curl wget nikto dmitry

The netcat-openbsd package provides the nc command used in the Netcat examples below.

Lab outline

Substitute your own addresses if VirtualBox assigns a different range. Set the target once, then reuse it in every command:

TARGET=192.168.56.114

Compare banner grabbing tools

The sections below walk Nmap, Netcat, curl, wget, Nikto, and Dmitry against the same Metasploitable host. Use this table to pick a tool before you scale up to multi-port scans.

Start with Nmap for discovery, then use Netcat or curl to manually verify anything you plan to exploit.

Grab banners with Nmap

Nmap is the default choice for banner work at scale. It combines port discovery, version detection (-sV), and the banner NSE script.

Grab the raw SSH banner with the banner script

Point the script at one port where you already know a service listens (SSH on port 22 on Metasploitable):

nmap -Pn -p 22 --script banner "$TARGET"

-Pn skips Nmap host discovery and scans the supplied address as though it is online. This is useful when discovery probes are blocked, although Nmap may still use ARP on a directly connected Ethernet network.

PORT   STATE SERVICE
22/tcp open  ssh
|_banner: SSH-2.0-OpenSSH_4.7p1 Debian-8ubuntu1

The |_banner: line is the raw greeting SSH sent when Nmap connected. That string is what you would see manually with Netcat on a text protocol.

Fingerprint the version with -sV

Version detection runs additional probes and prints a normalized product string:

nmap -Pn -p 22 -sV "$TARGET"

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)

Use -sV when you want a concise SERVICE VERSION column across many ports, not only the raw banner text.

Tune probe depth with --version-intensity

Nmap accepts intensity 0 through 9 (default 7). Higher values run more probes and take longer. On Metasploitable SSH, intensity 9 returned the same OpenSSH line as the default:

nmap -Pn -p 22 -sV --version-intensity 9 "$TARGET"

Raise intensity when -sV returns unknown on a non-default port. Lower it when you need a faster scan on a large subnet.

Scan several services in one pass

After a port scan, grab banners and versions on the ports that matter for your next exercise:

nmap -Pn -sV -p 21,22,80,139,445,5900 "$TARGET"

PORT     STATE SERVICE     VERSION
21/tcp   open  ftp         vsftpd 2.3.4
22/tcp   open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
80/tcp   open  http        Apache httpd 2.2.8 ((Ubuntu) DAV/2)
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
5900/tcp open  vnc         VNC (protocol 3.3)

The FTP, SSH, and HTTP rows provide specific product and version clues for further research. The Samba 3.X - 4.X and VNC protocol results are broader fingerprints, so use protocol-specific enumeration before selecting a CVE or Metasploit module. For broader recon patterns, see network reconnaissance with Nmap.

Grab banners with Netcat

Netcat (nc) is the manual approach: open a TCP connection and read whatever the service prints first. It works well for FTP, SMTP, and other line-based protocols.

Connect to FTP on port 21 and read the banner line:

nc "$TARGET" 21

220 (vsFTPd 2.3.4)

The 220 prefix is normal FTP syntax. The product string vsFTPd 2.3.4 is the same clue Nmap reported on port 21. Press Ctrl+C to close the session.

Netcat is a raw TCP client and can send a manually written HTTP request, but curl and wget are simpler when you only need response headers.

Grab HTTP headers with curl and wget

Web banners live in response headers (Server, X-Powered-By, and others), not in the HTML body.

curl

Request headers only with -I (HEAD). -sS hides the progress meter and shows errors if the connection fails:

curl -sS -I "http://$TARGET/"

HTTP/1.1 200 OK
Date: Sat, 01 Aug 2026 07:42:44 GMT
Server: Apache/2.2.8 (Ubuntu) DAV/2
X-Powered-By: PHP/5.2.4-2ubuntu5.10
Content-Type: text/html

Server names the web daemon; X-Powered-By exposes PHP. Both are classic banner-grabbing wins on outdated lab images. See the curl command guide for more header and download options.

wget

wget can print response headers to stderr while discarding the body:

wget -q -S -O /dev/null "http://$TARGET/"

HTTP/1.1 200 OK
  Date: Sat, 01 Aug 2026 07:42:44 GMT
  Server: Apache/2.2.8 (Ubuntu) DAV/2
  X-Powered-By: PHP/5.2.4-2ubuntu5.10
  Content-Length: 891
  Keep-Alive: timeout=15, max=100
  Connection: Keep-Alive
  Content-Type: text/html

-q quiets download progress; -S shows server headers. The wget command guide covers recursion and mirrors when you move past header inspection.

Grab banners with Nikto

Nikto is a web vulnerability scanner that also surfaces server banners and outdated components. It is louder and slower than curl -I, but it checks many paths and misconfigurations in one run.

Scan the Metasploitable web service on port 80:

nikto -h "$TARGET"

The first lines confirm the target and print the web server banner Nikto detected:

+ Target IP:          192.168.56.114
+ Target Port:        80
+ Server: Apache/2.2.8 (Ubuntu) DAV/2
+ [999986] /: Retrieved x-powered-by header: PHP/5.2.4-2ubuntu5.10.
+ [600625] PHP/5.2.4-2ubuntu5.10 appears to be outdated (current is at least 8.5.1).
+ [600050] Apache/2.2.8 appears to be outdated (current is at least 2.4.66).

Nikto adds value beyond a single header grab: it flags outdated Apache and PHP builds and probes common web paths. Expect a long report on real targets; trim or redirect output when you only need the banner section.

Grab banners with Dmitry

Dmitry (Deepmagic Information Gathering Tool) bundles WHOIS, subdomains, and port banner collection. The -pb flag combines a port scan (-p) with banner output (-b).

Run it against the lab IP:

dmitry -pb "$TARGET"

HostIP:192.168.56.114

Gathered TCP Port information for 192.168.56.114
---------------------------------

 Port		State

21/tcp		open
>> 220 (vsFTPd 2.3.4)

22/tcp		open
>> SSH-2.0-OpenSSH_4.7p1 Debian-8ubuntu1

25/tcp		open
>> 220 metasploitable.localdomain ESMTP Postfix (Ubuntu)

Dmitry may warn that it cannot resolve a hostname when you pass a bare IP. The port banner module still runs. Some binary protocols (telnet on port 23, for example) produce garbled banner lines; verify those with Nmap or a protocol-specific tool.

Map banners to CVE research

Record the service, version, and port before searching a CVE database:

A banner is only a clue. CVE-2011-2523 applies to vsFTPd 2.3.4 archives downloaded during a specific June–July 2011 period, so the version string alone does not prove that every vsFTPd 2.3.4 server is vulnerable. NVD confirms that limited affected-build scope.

When a CVE matches your lab fingerprint, continue with targeted exploitation in the Metasploitable 2 walkthrough — only on systems you are authorized to test.

Troubleshooting

References

• Nmap version detection
• Nmap banner NSE script
• Nikto project (GitHub)
• Dmitry (Kali tool page)
• CVE-2011-2523 (vsFTPd backdoor)
• curl manual
• GNU Wget manual
• Banner grabbing (Wikipedia)
• CVE Program
• Metasploitable 2 documentation (Rapid7)

Summary

Banner grabbing turns an open port into actionable intelligence: the difference between “something on 22” and “OpenSSH 4.7p1 on Linux.” In this lab you practiced that loop with Nmap’s banner script and -sV probes, manual Netcat reads on FTP, HTTP header pulls with curl and wget, a Nikto web pass, and Dmitry’s -pb port banners against Metasploitable 2.

Nmap remains the workhorse for multi-service labs because one scan fills a version table you can feed into CVE lookup or Metasploit search. The vsFTPd banner on port 21 is a worked example of that research step: a version string points you to CVE-2011-2523, but you still verify whether the build is actually affected. curl and wget stay the fastest HTTP banner checks; Nikto adds depth when you need outdated component warnings beyond a single Server header.

Treat every banner as a hypothesis until you verify it. Services can lie, hide behind proxies, or return incomplete strings on the first connect. When a version string looks exploitable, continue in your isolated lab with the Metasploitable 2 exploitation walkthrough — never against hosts you are not authorized to test.