Ethical Hacking Enumeration Syllabus

Which SMB version introduced pre-authentication integrity and AES-128-GCM encryption, and why does it matter for enumeration defense?

SMB 3.1.1 (Windows 10 / Server 2016). It matters because encryption and signing reduce the information an attacker can passively glean and prevent tampering/relay during enumeration and access.

Name two Nmap NSE scripts used specifically for SMB enumeration.

smb-enum-shares and smb-enum-users (also smb-os-discovery, smb-enum-domains, smb-enum-sessions).

What is the well-known IPC$ share and why is it targeted during SMB enumeration?

IPC$ (Inter-Process Communication) is a hidden administrative share used for named-pipe communication. Attackers connect to it (often via null session) to enumerate users, groups, shares and policies through RPC calls.

What does LDAP stand for and what is it used for?

Lightweight Directory Access Protocol. It is a protocol for accessing and maintaining distributed directory information services, commonly used for authentication and to query directory objects (users, groups, computers) such as in Microsoft Active Directory.

On which ports does LDAP operate for unencrypted and encrypted (SSL/TLS) connections?

LDAP uses TCP/UDP port 389 for unencrypted (and StartTLS) connections and TCP port 636 for LDAP over SSL/TLS (LDAPS).

What information can be enumerated via LDAP?

Valid usernames, email addresses, group memberships, organizational units (OUs), computer accounts, domain naming context (base DN), and other directory attributes stored in the directory service.

What is a 'Distinguished Name' (DN) in LDAP?

A DN is the unique full path that identifies an entry in the directory tree, built from a sequence of relative attributes, e.g. 'cn=John Doe,ou=Users,dc=example,dc=com'.

What is an anonymous LDAP bind and why is it a security concern?

An anonymous bind connects to the LDAP directory without credentials. If allowed, it lets attackers query and enumerate directory objects (users, groups) without authentication, exposing sensitive organizational structure.

Name two tools used for LDAP enumeration.

ldapsearch (OpenLDAP client) and Nmap's ldap-search NSE script. Others include JXplorer, ldapenum, and Windows tools like ADExplorer.

Write an example ldapsearch command to perform an anonymous query for all objects under a base DN.

ldapsearch -x -H ldap://<target> -b "dc=example,dc=com" (-x = simple/anonymous auth, -H = URI, -b = base DN).

What does NFS stand for and what is its purpose?

Network File System. It is a distributed file system protocol (originally by Sun Microsystems) that allows a client to access files over a network as if they were on local storage, common in Unix/Linux environments.

On which port does NFS typically run?

NFS typically runs on TCP/UDP port 2049. It also relies on the portmapper/rpcbind service on port 111.

What is the role of rpcbind/portmapper (port 111) in NFS enumeration?

rpcbind (portmapper) maps RPC program numbers to network ports. Querying it (e.g., with rpcinfo -p) reveals which RPC services—including mountd and nfsd—are running and on what ports, aiding NFS enumeration.

Which command lists the exported (shared) directories on an NFS server?

showmount -e <target> ('showmount -e' displays the export list; 'showmount -a' shows all mounted clients and directories).

What is the /etc/exports file and why is it relevant to NFS security?

/etc/exports on the NFS server defines which directories are shared, to which hosts, and with what permissions (e.g., rw, ro, no_root_squash). Misconfigurations like exporting to '*' or no_root_squash allow attackers to read/write files or gain root access.

What is the danger of the NFS 'no_root_squash' export option?

no_root_squash allows a remote client's root user to act as root on the exported filesystem. An attacker who mounts the share can create SUID root binaries or modify system files, potentially leading to full compromise.

What does SNMP stand for and what is it used for?

Simple Network Management Protocol. It is used to monitor and manage network devices (routers, switches, servers, printers) by collecting and organizing information about them and modifying device configuration.

On which ports does SNMP operate for agent queries and traps?

SNMP agents listen on UDP port 161 for queries (GET/SET), and SNMP traps (asynchronous notifications) are sent to the manager on UDP port 162.

What are the two default SNMP community strings and their access levels?

'public' provides read-only (RO) access, and 'private' provides read-write (RW) access. These defaults are a major enumeration/attack vector when left unchanged.

What is a Management Information Base (MIB) in SNMP?

A MIB is a hierarchical, tree-structured database of managed objects, each identified by an Object Identifier (OID). It defines the properties and data that an SNMP agent exposes for querying and management.

What is an OID in SNMP?

An Object Identifier is a dotted-numeric string (e.g., 1.3.6.1.2.1.1.5.0) that uniquely addresses a specific managed object/variable within the MIB tree hierarchy.

Which SNMP version first introduced strong authentication and encryption, and how do earlier versions differ?

SNMPv3 introduced authentication (user-based, e.g., MD5/SHA) and encryption (DES/AES). SNMPv1 and SNMPv2c rely only on plaintext community strings with no encryption, making them easy to enumerate and sniff.

Name two tools used for SNMP enumeration.

snmpwalk (Net-SNMP suite) and snmp-check. Others include onesixtyone (community string brute-forcer) and the Nmap snmp-* NSE scripts.

What does the command 'snmpwalk -v2c -c public <target>' do?

It performs a series of SNMP GETNEXT requests (a 'walk') over the MIB tree using SNMP version 2c and the community string 'public', dumping all readable OIDs and values from the target agent.

What sensitive information can SNMP enumeration reveal?

Network interfaces and IP/routing tables, ARP tables, running processes, installed software, open TCP/UDP ports, usernames, device uptime, hardware/OS details and shares.

On which port does SSH operate and what is its primary purpose?

SSH operates on TCP port 22 by default. It provides encrypted remote login and secure command execution, replacing insecure protocols like Telnet and rlogin.

What information can be enumerated from an SSH service without authentication?

The SSH protocol version and software banner (e.g., 'SSH-2.0-OpenSSH_8.9'), supported key exchange/cipher/MAC algorithms, host key fingerprints, and sometimes supported authentication methods—useful for OS fingerprinting and vulnerability matching.

How can you retrieve an SSH server's banner for enumeration using netcat?

nc <target> 22 (connecting to port 22 causes the server to send its identification banner, e.g., 'SSH-2.0-OpenSSH_8.9p1 Ubuntu'). You can also use 'ssh -v' or Nmap's banner script.

Which Nmap NSE scripts are useful for SSH enumeration?

ssh2-enum-algos (lists supported encryption/kex/MAC algorithms), ssh-hostkey (retrieves host keys), and ssh-auth-methods (enumerates supported authentication methods).

Compare SMB (port 445) and NetBIOS (port 139) session transport for SMB communication.

Port 139 carries SMB encapsulated within a NetBIOS session (legacy, requires NetBIOS over TCP/IP). Port 445 carries SMB directly over TCP/IP without NetBIOS, which is faster and used by modern Windows. Both may be probed during enumeration.

What are the primary countermeasures against enumeration attacks?

Disable unused services and null sessions, change default SNMP community strings (or use SNMPv3), restrict anonymous LDAP/SMB access, enforce firewall rules on ports 137-139/445/161/389/2049, use strong authentication and encryption, and monitor/log for suspicious active connections.