Module 04 — Enumeration

What is Enumeration?

Enumeration is the process of extracting detailed information from a target after identifying live hosts, open ports, and services during the scanning phase.

Unlike scanning, which tells us what is available, enumeration tells us what information we can gather from those services.

Why Do We Perform Enumeration?

Purpose:

• Identify users and groups
• Discover shared resources
• Find software versions
• Retrieve banners
• Collect domain information
• Enumerate DNS records
• Identify databases
• Discover hidden web content
• Find misconfigurations
• Prepare for exploitation

Scanning vs Enumeration

Enumeration Workflow

    Scanning
        |
        v
   Enumeration
        |
        v
Information Gathering
        |
        v
  Attack Planning

1. Scanning — discover live hosts, open ports and running services.
2. Enumeration — query each discovered service for detailed information.
3. Information Gathering — consolidate users, shares, versions, records and misconfigurations.
4. Attack Planning — select the most appropriate and efficient attack path.

Windows Enumeration

1. Nmap

Purpose

General enumeration of services, versions, OS, and NSE scripts.

Why use it?

• Detect service versions
• Enumerate SMB
• Enumerate FTP
• Enumerate HTTP
• Enumerate SNMP
• Run NSE scripts

Example:

nmap -sV -A <IP>

Official Download: Nmap Downloads

2. enum4linux-ng

Purpose

Enumerate Windows SMB and Samba services.

Why use it?

• Users
• Groups
• Shares
• Password policy
• Domain information
• NetBIOS names

Example:

enum4linux-ng <IP>

Official Download: enum4linux-ng GitHub

3. CrackMapExec / NetExec

Purpose

SMB, WinRM, MSSQL, LDAP, and Active Directory enumeration.

Why use it?

• Check credentials
• Enumerate shares
• Domain information
• Logged-in users
• Sessions
• AD information

Example:

netexec smb <IP>

Official Download: NetExec GitHub

4. rpcclient

Purpose

Enumerate Windows RPC services.

Why use it?

• Users
• Groups
• Domain SID
• Password policy

Example:

rpcclient -U "" -N <IP>

Official Download: Included with the Samba Project

5. smbclient

Purpose

Access SMB shares.

Why use it?

• List shares
• Browse files
• Download files

Example:

smbclient -L //<IP>

Official Download: Included with the Samba Project

Linux Enumeration

1. Nmap

Purpose

Service and version enumeration using NSE scripts.

Example:

nmap -sV -A <IP>

Official Download: Nmap Downloads

2. Nikto

Purpose

Enumerate web servers.

Why use it?

• Dangerous files
• Default pages
• Outdated software
• Security misconfigurations

Example:

nikto -h http://<IP>

Official Download: Nikto GitHub

3. Gobuster

Purpose

Directory and file enumeration.

Why use it?

• Hidden directories
• Backup files
• Admin panels
• API endpoints

Example:

gobuster dir -u http://<IP> -w wordlist.txt

Official Download: Gobuster GitHub

4. FFUF

Purpose

Fast web content discovery.

Why use it?

• Hidden directories
• Virtual hosts
• Parameters
• API endpoints

Example:

ffuf -u http://<IP>/FUZZ -w wordlist.txt

Official Download: FFUF GitHub

5. SNMPwalk

Purpose

SNMP enumeration.

Why use it?

• System information
• Network interfaces
• Running processes
• Hostname
• Installed software

Example:

snmpwalk -v2c -c public <IP>

Official Download: Included with Net-SNMP

6. LDAPSearch

Purpose

LDAP enumeration.

Why use it?

• Users
• Groups
• Organizational Units
• Domain information

Example:

ldapsearch -x -H ldap://<IP>

Official Download: Included with OpenLDAP

7. Dig

Purpose

DNS enumeration.

Why use it?

• DNS records
• Name servers
• MX records
• Zone transfers (if misconfigured)

Example:

dig any example.com

Official Download: Included with ISC BIND 9

Most Used Enumeration Tools

Windows

Linux

Windows Enumeration Tools — Official Downloads

Linux Enumeration Tools — Official Downloads

Enumeration Techniques

SMB Enumeration

Extracting information from SMB shares, including users, shared folders, password policies, domain information and accessible files.

enum4linux-ng <IP>
smbclient -L //<IP>
netexec smb <IP>

DNS Enumeration

Collecting DNS information such as A, AAAA, MX, NS, TXT and CNAME records, plus zone transfers if allowed.

dig any example.com

SNMP Enumeration

Retrieving information from network devices using SNMP: hostname, interfaces, running processes, installed software, routing tables and network configuration.

snmpwalk -v2c -c public <IP>

LDAP Enumeration

Retrieving directory information: users, groups, Organizational Units (OUs), domain structure and computer objects.

ldapsearch -x -H ldap://<IP>

Web Enumeration

Discovering hidden directories, hidden files, backup files, admin panels, API endpoints, virtual hosts and server technologies.

nikto -h http://<IP>
gobuster dir -u http://<IP> -w wordlist.txt
ffuf -u http://<IP>/FUZZ -w wordlist.txt

FTP Enumeration

Checking anonymous login, then listing files and directories and looking for backups, credentials, configuration files, source code or upload permissions.

nmap -sV -p 21 <IP>

SSH Enumeration

Identifying SSH version, supported authentication methods, supported algorithms, banner information and weak configurations.

nmap -sV -p 22 <IP>

SMTP Enumeration

Checking supported SMTP commands, testing for user enumeration (where supported) and reviewing security settings such as open relay protections.

nmap -sV -p 25 <IP>

RDP Enumeration

Identifying RDP service version, Network Level Authentication (NLA) status, TLS configuration and domain/workgroup information (when available).

nmap -sV -p 3389 <IP>

Active Directory Enumeration

Gathering information about an AD environment: users, groups, computers, Domain Controllers, trust relationships, group memberships and privileges.

netexec smb <IP>
ldapsearch -x -H ldap://<IP>

Anonymous Enumeration

Occurs when a service allows information to be retrieved without authentication, such as anonymous FTP access, SMB null sessions, public SNMP community strings (public) and open LDAP queries.

rpcclient -U "" -N <IP>

Service Enumeration

Identifies the running service, software version, configuration, available features and potential vulnerabilities.

nmap -sV <IP>

Banner Grabbing

Collecting information that a service provides when a connection is established: software name, version, operating system and service type.

SSH-2.0-OpenSSH_9.6

Common Enumeration Ports

Quick Revision

Service-wise Enumeration Cheat Sheet

SMB

Default Port: 445 (also 139)

Common Commands

nmap -sV -p 445 --script smb-enum-shares,smb-enum-users <IP>
enum4linux-ng <IP>
smbclient -L //<IP>
rpcclient -U "" -N <IP>
netexec smb <IP>

Useful Tools: Nmap, enum4linux-ng, smbclient, rpcclient, NetExec (CrackMapExec)

Information Retrieved: Users, groups, shared folders, password policy, computer name, domain name, NetBIOS information, active sessions

DNS

Default Port: 53

Common Commands

dig any example.com
dig axfr @<IP> example.com
nmap -sV -p 53 <IP>

Useful Tools: Dig, Nmap

Information Retrieved: A, AAAA, MX, NS, TXT and CNAME records, name servers, mail servers, subdomains, zone transfers (if misconfigured)

SNMP

Default Port: 161 (UDP)

Common Commands

snmpwalk -v2c -c public <IP>

Useful Tools: SNMPwalk (Net-SNMP), Nmap

Information Retrieved: Hostname, network interfaces, running processes, installed software, routing tables, network configuration, users

LDAP

Default Port: 389 (636 for LDAPS)

Common Commands

ldapsearch -x -H ldap://<IP>
netexec ldap <IP>

Useful Tools: ldapsearch (OpenLDAP), NetExec, Nmap

Information Retrieved: Users, groups, Organizational Units (OUs), domain structure, computer objects, service accounts

FTP

Default Port: 21

Common Commands

nmap -sV -p 21 <IP>
ftp <IP>

Useful Tools: Nmap, ftp client

Information Retrieved: FTP banner and version, anonymous login access, files and directories, backups, credentials, configuration files, source code, upload permissions

SSH

Default Port: 22

Common Commands

nmap -sV -p 22 <IP>
ssh -v <IP>

Useful Tools: Nmap, ssh client

Information Retrieved: SSH version, supported authentication methods, supported algorithms, banner information, weak configurations

HTTP

Default Port: 80 (443 for HTTPS)

Common Commands

nikto -h http://<IP>
gobuster dir -u http://<IP> -w wordlist.txt
ffuf -u http://<IP>/FUZZ -w wordlist.txt
curl -I http://<IP>

Useful Tools: Nikto, Gobuster, FFUF, Nmap, curl

Information Retrieved: Hidden directories and files, backup files, admin panels, API endpoints, virtual hosts, server technologies, dangerous files, default pages, outdated software, misconfigurations

SMTP

Default Port: 25

Common Commands

nmap -sV -p 25 --script smtp-commands,smtp-enum-users <IP>

Useful Tools: Nmap, smtp-user-enum

Information Retrieved: Supported SMTP commands, valid users (where supported), banner and software version, open relay protections

MySQL

Default Port: 3306

Common Commands

nmap -sV -p 3306 <IP>
mysql -h <IP> -u root -p

Useful Tools: Nmap, mysql client

Information Retrieved: MySQL version, authentication requirements, databases (if authorized), user accounts, configuration details

RDP

Default Port: 3389

Common Commands

nmap -sV -p 3389 <IP>

Useful Tools: Nmap

Information Retrieved: RDP service version, Network Level Authentication (NLA) status, TLS configuration, domain/workgroup information (when available)