I am working on an assignment where we are supposed to attack a private network simulated by a virtual machine provided to us using Kali. My Kali VM and the target network are on a 'host-only' private network in virtual box.

I scan the network using nmap and there is only a single other IP active so this leads me to the conclusion that the private netwwork is behind a router using NAT. Our task is:

"Using network scanners, extract the topology information of the company's private network. Identify available hosts, and for each host, find the IP address, Operating System, running services and open ports. Ensure that you specify the exact versions."

From what I can guess I am required to scan through the NAT to find details on the internal network but I can't seem to grasp how to do that.

The access point of the network has the following services available. enter image description here


To elaborate.The VM is supposed to emulate a companies private network. Its up and running and I can see the above services using nmap. I do know that I can use the browser to go to the IP of it ( which displays a website (I'm guessing via one of the available apache services). I can browse around the website and gain information on employees and their positions in the company so I have been running brute force attacks on the SSH and FTP service based off of usernames I have guessed and put into a list. I have run Ncrack and hydra on both my generated username list and generic ones for days with no results on SSH and FTP. The website gave me some email accounts as well but running Hydra on SMTP gives my a 'Auth not activated' so I'm guessing that's not possible. I'm still running more permutations of usernames via NCrack and hydra to gain access but I'm not having any luck.

Edit 2 For additional info I did a nessus scan. Here is the link to the report.

  • 1
    Can you please elaborate more ? You said that the targeted network and your attacking machine are on the same "host-only- network, so you should already know the other machines. Unless you're connected to some VPN (OSCP lab ?)
    – HSN
    Commented Feb 26, 2016 at 19:28
  • Try this script -- github.com/milo2012/metasploitHelper
    – atdre
    Commented Feb 26, 2016 at 19:59
  • Maybe the private network in on another interface of the initial machine that you can access. Compromise that and then you can use it to pivot onto the private network. Commented Feb 27, 2016 at 13:28

1 Answer 1


I can not say how exactly you can solve you're problem. But to collect information with kali, you can use 2 Types of tools scanner and sniffer. Until now it seems you only used Nmap(scanner)

Here a list of other tools.

Portscanner & Co.

  • Nmap(most common)
  • Lanspy
  • Essentiel NetTools
  • Winfingerprint
  • Xprobe2
  • p0f


  • dsniff-Suite(dsniff,mailsnarf,urlsnarf,arpspoof)
  • PHoss
  • Driftnet
  • Ettercap
  • tcpdump
  • Wireshark(most common)

I would give you the advice to use Wiresahrk or the dsniff-suite. Both of them are very powerful. The Difficulty is to filter the information , that you get only usefull information.

Look for steer-codes and headers

If normal methods are not working try:

  • ARP-Spoofing
  • MAC-flooding.
  • Since it is a VM and there aren't actually people on this private network I figured that it wouldn't have any traffic unless its a response to something I do. Can that still be used?
    – Nick
    Commented Feb 26, 2016 at 19:41
  • That depends if the system ont vm is online or if its offline? Basicelly a system which is online . Creates also traffic but less than if it's used. En example : The computer is still checking for updates an other stuff.
    – Mario di
    Commented Feb 26, 2016 at 19:53
  • Then I doubt it as this is on a 'host-only' network.
    – Nick
    Commented Feb 26, 2016 at 21:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .