Service Enumeration

Port scanning answers "what ports are open?". Enumeration goes further: "what services and versions are running, and how can they be exploited?" It is the process of actively querying services on open ports to gather structured information after scanning and discovery. You move from knowing the doors and windows exist to peeking inside.

What to enumerateSearch on YouTubeBookmarkSaved

FTP enumeration (port 21)Search on YouTubeBookmarkSaved

FTP (File Transfer Protocol) transfers files between computers over TCP/IP. It uses two channels — a command/control channel and a data channel — in a client-server model. Its drawback: data, including credentials, is sent in clear text. The secure variant is SFTP (Secure FTP, port 22), which authenticates both user and server; both FTP and SFTP use TCP.

nmap -p 21 --script ftp-anon <TARGET_IP>          # anonymous login allowed?
nmap -p 21 --script ftp-syst <TARGET_IP>          # system info
nmap -p 21 --script ftp-bounce <TARGET_IP>        # FTP bounce attack
nmap -p 21 --script ftp-brute <TARGET_IP>         # brute-force FTP creds
nmap -p 21 --script ftp-vsftpd-backdoor <TARGET_IP>  # vsftpd 2.3.4 backdoor
nmap -p 21 --script ftp-proftpd-backdoor <TARGET_IP>
nmap -p 21 --script "ftp-*" 192.168.10.149        # all ftp scripts (noisy/slow)

The most important script is ftp-anon (checks anonymous login). Some scripts (like the backdoor checks) not only detect but also exploit, so exploit results appear.

searchsploitSearch on YouTubeBookmarkSaved

searchsploit vsftpd           # search the local Exploit-DB copy by keyword
searchsploit -p <exploit>     # show the full path/details of an exploit
searchsploit -m <exploit>     # mirror (copy) an exploit to the current dir

searchsploit searches the local copy of the Exploit-DB repository for exploits related to a keyword. For example, vsftpd 2.3.4 has a famous backdoor in its code.

SMB enumeration (ports 139/445)Search on YouTubeBookmarkSaved

SMB (Server Message Block) is a client-server, request-response protocol for sharing files, printers and other resources on a network. Clients connect over TCP/IP. Windows has included SMB since Windows 95; Samba is the open-source SMB server for Unix.

A share is a folder, printer or resource made available over SMB. Examples: C$ (admin share of C:), ADMIN$ (system root), IPC$ (inter-process communication, no files, used for remote management), print$ (printer drivers), plus custom shares. Shares matter because misconfigured ones may allow unauthenticated (guest/anonymous) access, and some contain config files, password lists or backups.

enum4linux and smbclientSearch on YouTubeBookmarkSaved

nmap -p 139,445 <TARGET_IP>              # check SMB port status
enum4linux -a 192.168.56.106            # full enum: OS, NetBIOS, users, shares, policy
enum4linux -n <TARGET_IP>               # NetBIOS name info

sudo apt install smbclient
smbclient -L //192.168.56.110 -N        # list shares, -N = no password (anonymous)
smbclient //192.168.56.110/tmp -N       # connect to a share (interactive shell)

enum4linux -a extracts OS info, NetBIOS name, users, share listings and the password policy in one command. Inside an smbclient session:

Listing flags: D directory, R read-only, H hidden, S system, A archive, N normal.

The workflow: SMB detected → enumerate shares → identify accessible shares → investigate them for useful information. Anonymous SMB access may help you gain a shell.

SMB NSE scripts and smbmapSearch on YouTubeBookmarkSaved

nmap --script smb-os-discovery <TARGET_IP>         # OS / SMB version
nmap --script smb-enum-shares <TARGET_IP>          # list shares + our access
nmap -p 445 --script smb-enum-users <TARGET_IP>    # enumerate user accounts
nmap --script smb-vuln-ms17-010 <TARGET_IP>        # EternalBlue
nmap --script smb-vuln-ms08-067 <TARGET_IP>        # MS08-067 Windows RCE

• smb-enum-shares lists active shares and whether you have permission to access them.
• smb-enum-users enumerates local/domain users via the SMB service on port 445, using anonymous/null sessions where possible; valid usernames feed brute-force, privilege escalation or social engineering.
• smb-vuln-ms17-010 checks EternalBlue (MS17-010): unauthenticated remote code execution over SMB, used by WannaCry and NotPetya (2017) on unpatched SMBv1. A comparable Samba RCE is CVE-2017-7494.
• smbmap is a Python CLI to enumerate shares and test read/write permissions.

NetBIOS enumeration (ports 137/138 UDP, 139 TCP)Search on YouTubeBookmarkSaved

NetBIOS (Network Basic Input/Output System) is an older Windows networking protocol. It provides a name service (137, maps NetBIOS names to IPs), datagram service (138, connectionless) and session service (139, connection-oriented for file/printer sharing). NetBIOS enumeration extracts the computer's NetBIOS name, usernames and groups, domain/workgroup names, and network-resource details.

nbtstat -A <TARGET_IP>              # Windows: -A = by IP, -a = by name
nbtscan <TARGET_IP>                 # Linux
nbtscan 192.168.1.0/24
enum4linux -n <TARGET_IP>           # NetBIOS name info
nmap --script nbstat.nse -p 137 <TARGET_IP>   # NetBIOS name table via NBNS (UDP/137)

SNMP enumeration (UDP 161 queries, 162 traps)Search on YouTubeBookmarkSaved

SNMP (Simple Network Management Protocol) monitors and manages network devices (routers, switches, servers, printers). It runs over UDP port 161 (queries) and 162 (traps/alerts). Components:

• SNMP Manager — the central monitoring server that sends queries.
• SNMP Agent — runs on the managed device, stores data in a MIB, answers queries and sends alerts.
• MIB (Management Information Base) — a hierarchical tree of objects, each identified by an OID (Object Identifier), a dotted number string. Example: 1.3.6.1.2.1.1.5.0 = system name.

SNMP versions and community stringsSearch on YouTubeBookmarkSaved

The community string is like a password — a shared secret between manager and agent. Defaults are widely known and dangerous: public = read-only, private = read-write. If a device accepts the string, it returns the requested information.

snmpwalk -v2c -c public <TARGET_IP>   # walk the whole MIB tree (v2c, string "public")
snmp-check <TARGET_IP> -c public       # same data, more human-readable

snmpwalk traverses the OIDs and returns their values. A community wordlist (community.txt) might hold: public, private, manager, admin, test, guest.

Information gathered: system info (hostname, description, OS, uptime), network info (IPs, routing tables, ARP cache), user accounts and groups, running processes, installed software, open TCP/UDP ports, and device configuration (router ACLs, firewall rules). If a read-write string is found, the attacker could change configurations remotely.

DNS enumeration (port 53)Search on YouTubeBookmarkSaved

DNS translates domain names to IP addresses on port 53 and stores metadata: mail servers, subdomains, aliases. An application calls the resolver library, which queries name servers. Resolution is iterative or recursive (easier for the client). The authoritative name server holds a zone file of DNS records (A, AAAA, CNAME, MX, etc.).

DNS enumeration gathers DNS records to map a domain's infrastructure: subdomains and hostnames, internal domains, mail servers, name servers and zone transfers. Techniques and tools: whois, nslookup/dig, zone transfer (AXFR), dnsenum, fierce, dnsrecon, theHarvester, sublist3r.

dig record queriesSearch on YouTubeBookmarkSaved

dig A example.com              # IPv4 address
dig AAAA example.com           # IPv6 address
dig NS example.com             # name servers
dig MX example.com             # mail servers
dig TXT example.com            # TXT records (SPF, DKIM, verification)
dig SOA example.com            # start of authority / admin
dig CNAME www.example.com      # alias
dig ANY example.com            # any records
dig -x 142.250.66.14           # reverse lookup
dig +trace example.com         # full resolution path from the root
dig +short A example.com       # short answer (IP only)
dig @8.8.8.8 A example.com     # query a specific resolver
dig +dnssec example.com        # DNSSEC records

DNS zone transfer (AXFR)Search on YouTubeBookmarkSaved

A zone transfer replicates the DNS database between servers — a primary (master) transfers its records to a secondary (slave) to keep backups in sync. Full transfer is AXFR; incremental (updated records only) is IXFR. Its purpose is legitimate, but if a server is misconfigured and unrestricted, anyone can request a transfer and receive a full list of hostnames, subdomains and IP mappings — a blueprint of the network.

# via host
host -t ns zonetransfer.me                    # find the name servers
host -l <domain> <nameserver>                 # attempt a zone transfer

# via dig
dig zonetransfer.me -t ns                     # find the name servers
dig axfr zonetransfer.me @<nameserver>        # request the zone transfer
dig AXFR zonetransfer.me @nsztm1.digi.ninja   # worked example

If the domain is correctly configured, the attempt fails. A normal DNS query asks for one record; a zone transfer asks for the entire "phonebook".

HTTP enumeration via NSESearch on YouTubeBookmarkSaved

nmap --script http-apache-server-status <TARGET_IP>
nmap --script http-methods <TARGET_IP>        # allowed HTTP methods
nmap --script http-errors <TARGET_IP>
nmap --script http-grep <TARGET_IP>           # find IPs/emails in responses

http-grep works like Linux grep but searches the body of HTTP responses, finding IP addresses and email IDs by default.

Quick self-testSearch on YouTubeBookmarkSaved