Examius
🌍 Ethical Hacking · flashcards
Ethical Hacking Enumeration Flashcards
51 question-and-answer cards covering Enumeration as it is examined in Ethical Hacking. 24 of them are printed below, taken from across the deck — no signup, no paywall on the preview.
24 sample cards from the Enumeration deck
Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.
What is an anonymous LDAP bind and why is it a security concern?
An anonymous bind connects to the LDAP directory without credentials. If allowed, it lets attackers query and enumerate directory objects (users, groups) without authentication, exposing sensitive organizational structure.
Name two tools used for LDAP enumeration.
ldapsearch (OpenLDAP client) and Nmap's ldap-search NSE script. Others include JXplorer, ldapenum, and Windows tools like ADExplorer.
Write an example ldapsearch command to perform an anonymous query for all objects under a base DN.
ldapsearch -x -H ldap://<target> -b "dc=example,dc=com" (-x = simple/anonymous auth, -H = URI, -b = base DN).
What does NFS stand for and what is its purpose?
Network File System. It is a distributed file system protocol (originally by Sun Microsystems) that allows a client to access files over a network as if they were on local storage, common in Unix/Linux environments.
On which port does NFS typically run?
NFS typically runs on TCP/UDP port 2049. It also relies on the portmapper/rpcbind service on port 111.
What is the role of rpcbind/portmapper (port 111) in NFS enumeration?
rpcbind (portmapper) maps RPC program numbers to network ports. Querying it (e.g., with rpcinfo -p) reveals which RPC services—including mountd and nfsd—are running and on what ports, aiding NFS enumeration.
Which command lists the exported (shared) directories on an NFS server?
showmount -e <target> ('showmount -e' displays the export list; 'showmount -a' shows all mounted clients and directories).
What is the /etc/exports file and why is it relevant to NFS security?
/etc/exports on the NFS server defines which directories are shared, to which hosts, and with what permissions (e.g., rw, ro, no_root_squash). Misconfigurations like exporting to '*' or no_root_squash allow attackers to read/write files or gain root access.
What is the danger of the NFS 'no_root_squash' export option?
no_root_squash allows a remote client's root user to act as root on the exported filesystem. An attacker who mounts the share can create SUID root binaries or modify system files, potentially leading to full compromise.
What does SNMP stand for and what is it used for?
Simple Network Management Protocol. It is used to monitor and manage network devices (routers, switches, servers, printers) by collecting and organizing information about them and modifying device configuration.
On which ports does SNMP operate for agent queries and traps?
SNMP agents listen on UDP port 161 for queries (GET/SET), and SNMP traps (asynchronous notifications) are sent to the manager on UDP port 162.
What are the two default SNMP community strings and their access levels?
'public' provides read-only (RO) access, and 'private' provides read-write (RW) access. These defaults are a major enumeration/attack vector when left unchanged.
What is a Management Information Base (MIB) in SNMP?
A MIB is a hierarchical, tree-structured database of managed objects, each identified by an Object Identifier (OID). It defines the properties and data that an SNMP agent exposes for querying and management.
What is an OID in SNMP?
An Object Identifier is a dotted-numeric string (e.g., 1.3.6.1.2.1.1.5.0) that uniquely addresses a specific managed object/variable within the MIB tree hierarchy.
Which SNMP version first introduced strong authentication and encryption, and how do earlier versions differ?
SNMPv3 introduced authentication (user-based, e.g., MD5/SHA) and encryption (DES/AES). SNMPv1 and SNMPv2c rely only on plaintext community strings with no encryption, making them easy to enumerate and sniff.
Name two tools used for SNMP enumeration.
snmpwalk (Net-SNMP suite) and snmp-check. Others include onesixtyone (community string brute-forcer) and the Nmap snmp-* NSE scripts.
What does the command 'snmpwalk -v2c -c public <target>' do?
It performs a series of SNMP GETNEXT requests (a 'walk') over the MIB tree using SNMP version 2c and the community string 'public', dumping all readable OIDs and values from the target agent.
What sensitive information can SNMP enumeration reveal?
Network interfaces and IP/routing tables, ARP tables, running processes, installed software, open TCP/UDP ports, usernames, device uptime, hardware/OS details and shares.
On which port does SSH operate and what is its primary purpose?
SSH operates on TCP port 22 by default. It provides encrypted remote login and secure command execution, replacing insecure protocols like Telnet and rlogin.
What information can be enumerated from an SSH service without authentication?
The SSH protocol version and software banner (e.g., 'SSH-2.0-OpenSSH_8.9'), supported key exchange/cipher/MAC algorithms, host key fingerprints, and sometimes supported authentication methods—useful for OS fingerprinting and vulnerability matching.
How can you retrieve an SSH server's banner for enumeration using netcat?
nc <target> 22 (connecting to port 22 causes the server to send its identification banner, e.g., 'SSH-2.0-OpenSSH_8.9p1 Ubuntu'). You can also use 'ssh -v' or Nmap's banner script.
Which Nmap NSE scripts are useful for SSH enumeration?
ssh2-enum-algos (lists supported encryption/kex/MAC algorithms), ssh-hostkey (retrieves host keys), and ssh-auth-methods (enumerates supported authentication methods).
Compare SMB (port 445) and NetBIOS (port 139) session transport for SMB communication.
Port 139 carries SMB encapsulated within a NetBIOS session (legacy, requires NetBIOS over TCP/IP). Port 445 carries SMB directly over TCP/IP without NetBIOS, which is faster and used by modern Windows. Both may be probed during enumeration.
What are the primary countermeasures against enumeration attacks?
Disable unused services and null sessions, change default SNMP community strings (or use SNMPv3), restrict anonymous LDAP/SMB access, enforce firewall rules on ports 137-139/445/161/389/2049, use strong authentication and encryption, and monitor/log for suspicious active connections.
What this deck covers
The Enumeration deck follows the Ethical Hacking Enumeration syllabus — 3 chapters and 9 topics — so questions land on material that is genuinely examinable rather than trivia around it. That works out to roughly 17.0 cards per chapter.
Answers are written to be recallable, not just readable — averaging about 186 characters, which is long enough to carry the reasoning and short enough to say out loud.
A deck like this earns its keep on the second and third pass. Read the syllabus first so you know the shape of the subject, then use the cards to find the specific facts that have not stuck.
Enumeration flashcards FAQ
How many Enumeration flashcards are in this Ethical Hacking deck?
51 cards. This page previews 24 of them, sampled evenly across the deck so you can judge the difficulty before installing anything.
Are these Ethical Hacking flashcards free?
Yes. The preview here is free to read with no signup, and the full 51-card deck is free inside the Examius app.
What do the Enumeration cards cover?
They follow the Ethical Hacking Enumeration syllabus — 3 chapters and 9 topics — so the questions track what is actually examinable.
How should I use these flashcards?
Read the syllabus first so you know the shape of the subject, then drill the deck. Examius schedules each card with spaced repetition, so cards you keep missing come back sooner and ones you know drift further apart.