Build1 publisher2 min readPublished
Wazuh saw the brute force and the Nikto scan, but the nmap sweep left no trace
A full attack chain against a self-hosted lab shows a clean split: reconnaissance that never authenticates logs nothing, while every login attempt and HTTP request produces correlated alerts.
The Engineer · Build desk
What happened
- The nmap reconnaissance phases, host discovery and version scanning, produced no Wazuh alerts because nmap never attempts to authenticate.
- A single Nikto scan sent 8,283 requests at Apache and surfaced open directory indexing, HTTP TRACE, missing security headers, and Shellshock probes.
- Metasploitable2 ran Ubuntu 8.04, below Wazuh's Debian 10 support floor, so it carried no agent and existed only to show exposure.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- constraint An authentication-based logging system cannot see reconnaissance that never authenticates, so nmap sweeps and version scans stay outside agent coverage by design.
- capability Once real login attempts and HTTP requests hit the watched host, a stock ruleset correlated thousands of events without anyone watching the defensive console.
- decision Where you place the agent decides what gets logged: the unmonitored Metasploitable2 box showed exposure but recorded nothing, while the agent-enrolled container recorded everything.
- cost The detection depended on the agent and default rules, and the attack succeeded on the world's most common password.
The coverage line falls exactly where authentication begins. That is the useful result of this exercise, and it follows from how the tooling works.
nmap ran first. The host discovery sweep used `-sn`, which tells nmap to skip ports and only report which hosts are alive [2]. The version scan that followed identified open ports and the software behind them [3]. Neither step tries to log in to anything. A logging system built on authentication events has nothing to record, so reconnaissance produced no alert at all [8].
The version scan against Metasploitable2 returned 24 open ports, including vsftpd 2.3.4 with its known public backdoor, unencrypted telnet, and a port labelled as a Metasploitable root shell [4]. That box runs Ubuntu 8.04, below Wazuh's minimum supported floor of Debian 10, so it carries no agent [1]. It is there to show real exposure. The watched target is a separate container running the Wazuh agent, exposing SSH on 2222 and Apache on 8080 [5].
Phase three is where the logs start. Against SSH, the author ran Hydra with a wordlist drawn from rockyou.txt, the password set leaked in a real 2009 breach that Kali ships preinstalled [6]. The target was set to 123456, which the same list ranks as the most common password in the world [9]. Hydra found it in five seconds across about 20 attempts [7]. Wazuh fired rule 40112, level 12, "Multiple authentication failures followed by a success" [10].
The web scan told the same story. Nikto sent 8,283 automated requests at the target's Apache, finding open directory indexing, the HTTP TRACE method enabled and vulnerable to Cross-Site Tracing, missing security headers, and Shellshock probe patterns [11]. That single automated scan produced thousands of correlated events on the defensive side without anyone watching the screen [12].
Worth copying if you build this lab: the Wazuh stack itself, dashboard, indexer and API, was bound only to 127.0.0.1 on the host, so neither Kali nor the real network could reach it [13]. Without that binding, a scan against your own machine reveals the SIEM in the results, which is both a real security problem and a broken demonstration [13]. And the entire lab ran on an isolated VMware host-only network at 192.168.220.0/24, with no route to the real network or the internet [14].
The password that broke the server was 123456, and the fix for that specific vector is a long unique password [9][15]. The detection side needed no expensive tooling either. What separated an intrusion nobody knew about from one recorded with the user, the IP and the exact timestamp was the agent and a stock ruleset [16].
What to watch
- Whether adding network flow or packet-based detection to the lab would close the reconnaissance blind spot that authentication logging leaves open.
- Whether the same rule 40112 fires reliably against slower, distributed brute-force attempts, unlike the fast 20-try run tested here.
- Whether an agent installed on an older OS like Metasploitable2 would change what the version-scan phase records.