Module 4: Enumeration

Section 1: Enumeration Concepts

Enumeration extracts user names, host names, network names, and service information from a system. It goes beyond scanning by actively querying services for detailed information.

Section 2: NetBIOS Enumeration

NetBIOS sessions provide names of running systems, IP addresses, and domain information. Tools: nbtstat, enum4linux, NBTOOL.

Section 3: SNMP Enumeration

SNMP community strings (public/private) can enumerate system info, running processes, routing tables, and ARP tables. Tools: snmpwalk, Nessus.

Section 4: LDAP Enumeration

LDAP queries extract user accounts, groups, password policies, and service accounts from Active Directory directories.

Section 5: SMTP & DNS Enumeration

SMTP enumeration via VRFY/EXPN commands reveals valid email addresses. DNS zone transfers (AXFR) expose entire domain records.