I am studying CREST CPSA where the syllabus is listed here.
There is a part of the syllabus which states I should know the Evaluation of responsive but unknown network applications.
I find this interesting, as with my limited experience in penetration testing thus far, every nmap scan I have done has been a well-known port number, there has been a service name attached such as Apache (with, or without, a version number), and failing that I have used a tool like telnet to connect to the port to read banner information.
I was curious if, at this basic level, there are any other approaches that one could take to identify responsive yet unknown network applications?
