> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/ethical-hacking/topic-7-enumeration-and-service-identification.md). # Topic 7: Enumeration and Service Identification ### Simple Explanation Scanning tells you *which doors are unlocked* (open ports). Enumeration is when you actually *open those doors a little and peek inside* extracting detailed information like usernames, shared folders, network resources, and configurations directly from the services running on those ports. *** ### 1. What is Enumeration? Enumeration is the process of **actively connecting to a system/service** and extracting detailed information such as: * Usernames and group names * Machine names * Shared resources (network shares, printers) * Services and their configurations * Routing tables, SNMP data, applications running It requires an **active connection** to the target (unlike passive footprinting), and usually happens **after** scanning has revealed which ports/services are open. ### 2. Why Enumeration Matters Enumeration often reveals the exact information needed to actually break in — e.g., a valid username is half of the password-guessing puzzle solved. It bridges the gap between "here's an open port" and "here's how I can actually log in." ### 3. Techniques and Protocols Commonly Enumerated #### A. NetBIOS Enumeration (Windows Networks) * **NetBIOS (Network Basic Input/Output System)** — runs mainly on port **139** (and works with SMB on 445). * Reveals: computer names, domain/workgroup names, shared folders, logged-on users, running services. * Tools: `nbtstat` (Windows built-in), `nbtscan`, `enum4linux`. * `nbtstat -A ` shows the NetBIOS name table of a remote system. #### B. SNMP Enumeration * **SNMP (Simple Network Management Protocol)** — used to manage/monitor network devices (routers, switches, printers), runs on UDP port **161**. * Uses a "community string" as a weak form of authentication — default strings like `public` (read-only) and `private` (read-write) are a classic vulnerability if not changed. * If community strings are guessable, an attacker can extract huge amounts of info: network interfaces, routing tables, running processes, installed software, usernames. * Tools: `snmpwalk`, `snmp-check`, `onesixtyone` (SNMP community string brute-forcer). #### C. LDAP Enumeration * **LDAP (Lightweight Directory Access Protocol)** — used to access and query directory services like Microsoft Active Directory, port **389** (or 636 for LDAPS/encrypted). * Reveals: usernames, organizational structure, computer names, group memberships, and sometimes password policies. * Tools: `ldapsearch`, Windows tool `ldp.exe`, `JXplorer`. #### D. NTP Enumeration * **NTP (Network Time Protocol)** — synchronizes clocks across systems, port **123**. * Can reveal hosts connected to an NTP server, internal IP addressing, and system uptime. * Tools: `ntpq`, `ntptrace`. #### E. SMTP Enumeration * **SMTP (Simple Mail Transfer Protocol)** — used for sending email, port **25**. * SMTP servers respond differently to valid vs invalid usernames using commands like `VRFY`, `EXPN`, and `RCPT TO`, allowing an attacker to enumerate valid email accounts/usernames. * Tools: `smtp-user-enum`, manual telnet interaction. #### F. SMB / File Share Enumeration * **SMB (Server Message Block)** — Windows file/printer sharing protocol, port **445**. * Reveals shared folders/drives, and if permissions are weak, may allow reading/writing files without authentication ("null sessions"). * Tools: `smbclient`, `enum4linux`, `smbmap`, Nmap NSE scripts (`smb-enum-shares`). #### G. DNS Enumeration * Covered in detail in its own topic — finding subdomains, records, and attempting zone transfers. #### H. Linux/Unix User Enumeration * **finger** protocol (older, largely deprecated now) could reveal usernames and login times. * **rpcinfo** — enumerates RPC (Remote Procedure Call) services running on a Unix/Linux host. ### 4. Null Sessions (classic Windows vulnerability, exam favorite) A **null session** is an unauthenticated connection to a Windows system (using blank username and password) that, on older/misconfigured systems, could still be used to enumerate shares, users, and policies via SMB/NetBIOS. Modern Windows systems restrict this by default, but it's a classic historical vulnerability that's frequently asked in exams. ### 5. Enumeration Methodology (general order) 1. Extract usernames using OS/protocol-specific tricks (SNMP, SMTP VRFY, null sessions). 2. Extract group information and membership. 3. Extract network resources and shares. 4. Extract applications and banners (crosses over with banner grabbing from scanning phase). 5. Extract system information, routing tables, and audit/security policy settings if possible. ### 6. Countermeasures Against Enumeration * Disable unnecessary services (SNMP, NetBIOS, NTP, SMTP VRFY/EXPN) if not needed. * Change default SNMP community strings; move to SNMPv3 which supports proper authentication and encryption. * Restrict null session access on Windows (`RestrictAnonymous` registry setting). * Limit SMB share permissions using least privilege. * Use firewalls to restrict enumeration ports (139, 389, 445, etc.) to only trusted internal IPs. * Monitor and log enumeration attempts using IDS. * Disable directory browsing and unnecessary verbose banners on services. ### Practical / Lab Notes Common practical commands: ``` enum4linux -a # All-in-one Windows/Samba enumeration smbclient -L \\ # List SMB shares nbtstat -A # NetBIOS name table (Windows) snmpwalk -v1 -c public # SNMP walk with default community string ldapsearch -x -h -b "dc=example,dc=com" # LDAP query smtp-user-enum -M VRFY -U userlist.txt -t # SMTP username enumeration ``` *** ### Exam Points (Quick Revision) * Enumeration = active extraction of detailed info (usernames, shares, services) after scanning. * Key protocols/ports: NetBIOS (139), SMB (445), SNMP (UDP 161), LDAP (389), NTP (123), SMTP (25). * SNMP default community strings: `public` (read), `private` (read-write) — classic vulnerability. * Null session = unauthenticated SMB/NetBIOS connection using blank credentials. * SMTP `VRFY`/`EXPN`/`RCPT TO` commands can leak valid usernames. * Tools to remember: enum4linux, nbtstat, snmpwalk, ldapsearch, smtp-user-enum, smbclient. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://alham-rizvi.gitbook.io/alhamrizvi/ethical-hacking/topic-7-enumeration-and-service-identification.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.