Ethical Hacking Enumeration Syllabus

Enumeration syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Enumeration in Ethical Hacking, not a summary of it.

1. 1

   Enumeration Concepts

   3 topics

   • What is Enumeration?
   • Techniques and Tools
   • Common Enumeration Targets
2. 2

   Windows Enumeration

   3 topics

   • NetBIOS Enumeration
   • SMB Enumeration
   • LDAP Enumeration
3. 3

   Linux/Unix Enumeration

   3 topics

   • NFS Enumeration
   • SNMP Enumeration
   • SSH Enumeration

Enumeration flashcards for Ethical Hacking

22 of 51 cards from the Enumeration deck — real questions with worked answers.

1. What is enumeration in the context of ethical hacking?

   Enumeration is the active process of extracting detailed information from a target system by establishing active connections and sending directed queries. It gathers usernames, machine names, network shares, services, routing tables and other resources that can be used to identify attack vectors.

2. In which phase of the hacking methodology does enumeration occur, and what precedes it?

   Enumeration is the third phase, following reconnaissance (footprinting) and scanning. It comes after the attacker has identified live hosts and open ports, and precedes gaining access (system hacking).

3. How does enumeration differ from scanning?

   Scanning discovers live hosts, open ports and services passively/semi-actively, whereas enumeration goes further by creating active connections to extract detailed resource-level information such as user accounts, shares and service configurations.

4. Why is enumeration considered an 'active' and intrusive technique?

   Because it requires establishing direct, active connections to the target and issuing queries against its services. This generates traffic and logs on the target, making it detectable and potentially illegal without authorization.

5. List four key categories of information an attacker seeks during enumeration.

   1) Network resources and shares, 2) Usernames and group memberships, 3) Machine/host names and OS details, 4) Running services, applications and their configurations (plus routing tables, SNMP and DNS details).

6. What is a 'null session' and why is it significant in enumeration?

   A null session is an unauthenticated connection to a Windows IPC$ share established with a blank username and password. It historically allowed attackers to enumerate users, groups, shares and policies on older Windows systems without credentials.

7. Name three general-purpose tools commonly used for enumeration.

   Nmap (with NSE scripts), Metasploit auxiliary modules, and enum4linux. Others include Nessus, SuperScan, Hyena and the SysInternals suite.

8. What is the Nmap Scripting Engine (NSE) and how does it aid enumeration?

   NSE is a Lua-based scripting framework built into Nmap that automates tasks like service enumeration, vulnerability detection and brute forcing. Scripts such as smb-enum-users, snmp-info and ldap-search perform protocol-specific enumeration.

9. What is enum4linux used for?

   enum4linux is a Perl wrapper around Samba tools (smbclient, rpcclient, net, nmblookup) used to enumerate information from Windows and Samba systems over SMB/NetBIOS, including users, groups, shares, password policies and OS details.

10. List five common enumeration targets (protocols/services) that ethical hackers focus on.

    NetBIOS (139), SMB (445), SNMP (161/UDP), LDAP (389/636), NFS (2049), plus SMTP (25), DNS (53), SSH (22) and NTP (123).

11. On which port and transport does NetBIOS Session Service operate?

    NetBIOS Session Service operates on TCP port 139. (NetBIOS Name Service uses UDP 137 and Datagram Service uses UDP 138.)

12. What are the three services provided by NetBIOS and their ports?

    1) Name Service (UDP 137), 2) Datagram Service (UDP 138), 3) Session Service (TCP 139).

13. What is the maximum length and structure of a NetBIOS name?

    A NetBIOS name is a 16-character ASCII string: the first 15 characters identify the device/resource, and the 16th character is a suffix (service/resource type code) that specifies the record type.

14. What does a NetBIOS suffix code of $<20>$ indicate?

    A suffix of $<20>$ indicates the File Server Service is running, meaning the machine is sharing files or has resources available. (Suffix $<00>$ = Workstation Service; $<1C>$ = Domain Controller group.)

15. Which Windows command-line tool displays NetBIOS name table information for a host?

    nbtstat. For example, 'nbtstat -A <IP>' lists the remote machine's NetBIOS name table, and 'nbtstat -a <name>' does so by name.

16. Name two dedicated tools used for NetBIOS enumeration besides nbtstat.

    nbtscan and SuperScan (also Hyena and the Nmap nbstat NSE script).

17. What port does SMB use for direct hosting over TCP/IP (without NetBIOS)?

    TCP port 445. Modern SMB (SMB over TCP/'direct host') runs on 445, while legacy SMB over NetBIOS uses TCP 139.

18. What is the SMB protocol primarily used for?

    Server Message Block (SMB) is an application-layer protocol providing shared access to files, printers, serial ports and inter-process communication between nodes on a network, primarily in Windows environments.

19. Which tool suite command in enum4linux would you use to list SMB shares, and what underlying tool does it call?

    enum4linux -S <target> lists shares; it invokes smbclient (specifically 'smbclient -L') and net/rpcclient under the hood.

20. What is the smbclient command to list available shares on a target anonymously?

    smbclient -L //<target> -N (the -N flag suppresses the password prompt for a null/anonymous session).

21. Which SMB version introduced pre-authentication integrity and AES-128-GCM encryption, and why does it matter for enumeration defense?

    SMB 3.1.1 (Windows 10 / Server 2016). It matters because encryption and signing reduce the information an attacker can passively glean and prevent tampering/relay during enumeration and access.

22. Name two Nmap NSE scripts used specifically for SMB enumeration.

    smb-enum-shares and smb-enum-users (also smb-os-discovery, smb-enum-domains, smb-enum-sessions).

See more Enumeration flashcards →

Planning Enumeration for Ethical Hacking

Enumeration (Ethical Hacking) FAQ