Banner grabbing
Connect to a port and read what the server voluntarily discloses — version, OS, software.
"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3" tells the attacker which OpenSSH to look for exploits against. Defences: hide banners, patch fast, assume the version leaks. Nmap, Shodan automate this for the entire internet.