What Command Should Follow an Nmap Scan Showing an Open MSSQL Port?
A penetration tester runs an Nmap scan and obtains the following output: Which of the following commands should the penetration tester try next to explore this server? - 
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests whether you can map an Nmap-discovered service to the correct next exploitation command; the trap is selecting a tool aimed at a port that is not open or that scans the wrong default port.
In CompTIA PT0-002, Nmap output that shows port 1433 open should lead to a targeted MSSQL credential attack with Medusa. Community consensus strongly favors option D because other ports are absent or the other tools use incorrect default ports.
Choosing A (nikto -host http://10.22.2.2) is the most common mistake. Testers see the web service and select Nikto, but Nikto defaults to port 80; since the Nmap output showed the HTTP port as 8080, this scan would fail to explore the actual service.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The Nmap output identifies port 1433, which is the default port for Microsoft SQL Server. Option D uses Medusa with the -M mssql module, targeting the sa account with a password list. This is a logical next step because SQL Server often uses weak or default credentials, and Medusa is a dedicated online password attacking tool. The syntax in D is valid and matches the service discovered by Nmap.
Why the Other Options Are Wrong
Option A is incorrect because Nikto scans port 80 by default unless you specify another port, and the Nmap output shows the web service on 8080, not 80. Option B targets FTP with Hydra, but the Nmap output does not list port 21 as open, so the attack would be wasted. Option C targets port 3389 with a VNC script, but 3389 is RDP, not VNC, and there is no indication that RDP is open; the MSSQL service on 1433 is the prominent open port. Only D aligns directly with an open, attackable service.
Community Comment Notes
A highly-voted comment correctly points out that option A should be nikto -h http://10.22.2.2:8080 because the correct port is 8080, not 80. Another comment agrees with D and explains that since only port 8080 is open, a default Nikto scan will fail. A third comment reinforces that there is no port 80 available for Nikto. No comments dispute D, and the exam consensus is unanimous in favor of D.
Official Reference
Exam Strategy
On the exam, always map each open port to the correct service and then choose the tool that explicitly targets that service. Also verify default ports for tools like Nikto; if Nmap shows 8080 rather than 80, the command must include the correct port or it will fail.