What Command Should Follow an Nmap Scan Showing an Open MSSQL Port?
Short answer
D medusa -h 10.22.2.2 -n 1433 -u sa -P passwords.txt -M mssql
Question
Key Takeaways
The exam tests whether you can map an Nmap-discovered service to the correct next exploitation command; the trap is selecting a tool aimed at a port that is not open or that scans the wrong default port.
In CompTIA PT0-002, Nmap output that shows port 1433 open should lead to a targeted MSSQL credential attack with Medusa. Community consensus strongly favors option D because other ports are absent or the other tools use incorrect default ports.
Common mistake: Choosing A (nikto -host http://10.22.2.2) is the most common mistake. Testers see the web service and select Nikto, but Nikto defaults to port 80; since the Nmap output showed the HTTP port as 8080, this scan would fail to explore the actual service.
Expert Analysis
Why the Answer Is Correct
The Nmap output identifies port 1433, which is the default port for Microsoft SQL Server. Option D uses Medusa with the -M mssql module, targeting the sa account with a password list. This is a logical next step because SQL Server often uses weak or default credentials, and Medusa is a dedicated online password attacking tool. The syntax in D is valid and matches the service discovered by Nmap.
Why the Other Options Are Wrong
Option A is incorrect because Nikto scans port 80 by default unless you specify another port, and the Nmap output shows the web service on 8080, not 80. Option B targets FTP with Hydra, but the Nmap output does not list port 21 as open, so the attack would be wasted. Option C targets port 3389 with a VNC script, but 3389 is RDP, not VNC, and there is no indication that RDP is open; the MSSQL service on 1433 is the prominent open port. Only D aligns directly with an open, attackable service.
Community Comment Notes
A highly-voted comment correctly points out that option A should be nikto -h http://10.22.2.2:8080 because the correct port is 8080, not 80. Another comment agrees with D and explains that since only port 8080 is open, a default Nikto scan will fail. A third comment reinforces that there is no port 80 available for Nikto. No comments dispute D, and the exam consensus is unanimous in favor of D.
Official Reference
These links open the official vendor documentation in a new tab.
Exam Strategy
On the exam, always map each open port to the correct service and then choose the tool that explicitly targets that service. Also verify default ports for tools like Nikto; if Nmap shows 8080 rather than 80, the command must include the correct port or it will fail.
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
wdmssk 👍 3 Answered DA is incorrect. The correct option is: nikto -h http://10.22.2.2:8080
-
kinny4000 👍 1 Answered DI hate to agree with D, normally bruteforcing would come much later than a vulnerability scan, but nikto will scan port 80 by default unless explicitly mentioned. Since only port 8080 is open, the nikto scan will fail.
-
CEH_2024 👍 1There isn't a port 80 to do a nikto scan
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.