Give Nmap real targets to scan

Lab 11 got Nmap running against scanme.nmap.org — safe, but limited to whatever the Nmap project is willing to expose to strangers. This lab uses Docker Compose to stand up a private, disposable target range so you can run the deeper scans Chapter 5 covers — service enumeration, script scanning — without going near a network you don't control.

WHY THIS LAB

Old on purpose, isolated on purpose

Metasploitable2 and DVWA are two of the most-used training targets in the field, for the same reason: they're deliberately outdated, with real services and real vulnerabilities to enumerate, and neither has any business being reachable from the internet. Docker Compose puts both on one throwaway network alongside a Kali scanner. One command tears the whole range down when you're done — nothing to clean up, nothing left running.

SAME IDEA, DIFFERENT SCOPE

Lab 4 got Docker Desktop running. Lab 11 got Nmap scanning a network. This lab is the two of them meeting each other, plus something worth scanning.

BEFORE YOU START

What you'll need

ALREADY INSTALLED

Docker Desktop, running — see Lab 4 if you haven't set it up yet.

DISK SPACE

Roughly 2 GB for the three images (Kali, Metasploitable2, DVWA) the first time you build the range.

NETWORK

Needed only for the first docker compose up, to pull the images. Everything after that runs offline.

TIME

20–30 minutes.

CyberCorps.uk · Lab 12 Page 1 of 3

BUILD IT · SCAN IT CyberCorps.uk · LAB 12

PART 1 · BUILD THE RANGE

One file, one command

Create a project folder — e.g. C:\labs\nmap-range — and save this as docker-compose.yml inside it:

services:
  scanner:
    image: kalilinux/kali-rolling
    command: sleep infinity
    networks: [lab_net]
  metasploitable:
    image: tleemcjr/metasploitable2
    networks: [lab_net]
  dvwa:
    image: vulnerables/web-dvwa
    ports: ["8080:80"]
    networks: [lab_net]
networks:
  lab_net:
    driver: bridge

Bring it up, then confirm it's running. In that folder:
```
docker compose up -d
docker compose ps
```
First run pulls all three images, which takes a few minutes; after that, starting the range takes seconds. All three services should show as running.

PART 2 · SCAN BY NAME, NOT BY IP

Get on the scanner and go

Open a shell in the Kali container and install Nmap — the rolling image ships with no tools by default:
```
docker compose exec scanner bash
apt update && apt install -y nmap
```
Enumerate services on Metasploitable:
```
nmap -sV metasploitable
```
Compose's built-in DNS means the target's service name resolves on its own — no IP address to go hunt for.
Run NSE scripts against the web app:
```
nmap --script http-enum,http-title -p 80 dvwa
```
You can also open http://localhost:8080 in a normal browser to see DVWA's own login screen (admin / password).
Tear it down when you're finished. Exit the Kali shell, then from PowerShell (not inside the container):
```
docker compose down
```
Every container and the network they were on is gone.

CyberCorps.uk · Lab 12 Page 2 of 3

EXAMPLES · CAUTIONS · SOURCES CyberCorps.uk · LAB 12

EXAMPLES TO TRY

Four more scans worth running

Command	What it does
`nmap -p- metasploitable`	Every TCP port, not just the top 1,000 — slower, but nothing hides.
`nmap --script vuln metasploitable`	Runs Nmap's built-in “vuln” script category — checks for known issues in whatever it finds listening.
`nmap -sV -sC metasploitable`	Version detection plus Nmap's default script set in one pass — a fast, reasonable first scan of any target.
`nmap -O metasploitable`	OS fingerprinting. Treat it as a guess here — a virtual bridge network can make it less reliable than scanning real hardware.

BEFORE YOU RELY ON IT

Two things to keep in mind

EIGHT YEARS STALE, AND THAT'S FINE

Docker itself flags the Metasploitable2 image as outdated — it hasn't been rebuilt in years, and a couple of services (Bind9, NFS) won't come up. That's a lesson too: an unmaintained image is itself a finding, the same as an unpatched server would be.

NEVER PUBLISH THESE FURTHER

DVWA's own documentation says not to deploy it to any public-facing server. Keep both targets on the isolated lab_net network and don't map any ports beyond the one this lab uses for the DVWA login screen.

Sources. Docker Hub, tleemcjr/metasploitable2 and vulnerables/web-dvwa image pages. Kali Linux, official Docker image, hub.docker.com/r/kalilinux/kali-rolling. Docker, Compose installation and CLI reference, docs.docker.com/compose. The Metasploitable2 and DVWA images were both last published roughly eight years ago and are unmaintained — expect a handful of dead services, and re-check Docker Hub before teaching this lab live in case either has been pulled.

CyberCorps.uk · Lab 12 Page 3 of 3