CoreQ Academy2.2 Given a scenario, apply enumeration techniques.
Enumeration turns a list of hosts into detail: operating systems, services, users, shares, secrets and the paths between them.
Host and service enumeration
- Operating system (OS) fingerprinting
- Identifying the OS from how it responds to network probes.
- Service discovery
- Finding which services run on which ports.
- Protocol enumeration
- Querying protocols (SMB, SNMP, LDAP) for detail.
- DNS enumeration
- Finding hostnames via brute-forcing subdomains or misconfigured zone transfers.
- Directory enumeration
- Discovering hidden web paths and files.
- Host discovery
- Identifying live hosts with ping sweeps or ARP scans.
- Share enumeration
- Listing accessible file shares and permissions.
- Local user enumeration
- Listing accounts on a compromised host.
- Email account enumeration
- Confirming valid addresses via mail server responses or login pages that reveal whether an account exists.
- Wireless enumeration
- Identifying SSIDs, encryption types, clients and access points.
Permissions and secrets
- Permission enumeration
- Discovering what the current identity can access or change.
- Secrets enumeration
- Searching for exposed credentials.
- Cloud access keys
- Keys in code, config files or environment variables.
- Passwords
- Credentials in scripts, configs, shares or browser stores.
- API keys
- Tokens for third-party or internal APIs.
- Session tokens
- Tokens that can be replayed to impersonate a user.
- Attack path mapping
- Linking permissions and relationships to find routes to high-value targets (e.g. with BloodHound).
Web enumeration
- Web application firewall (WAF) enumeration
- Detecting whether a WAF is in front of a site and which one.
- Origin address
- Finding the real server IP behind a CDN or WAF, which may allow bypassing protection.
- Web crawling
- Automatically following links to map a site.
- Manual enumeration
- Hand-reviewing a site for hidden functions and clues.
- Robots.txt
- A file telling crawlers what not to index; often lists sensitive paths.
- Sitemap
- An XML list of site pages that reveals structure.
- Platform plugins
- Identifying CMS plugins and versions, a common source of vulnerabilities.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 2.2 of the publicly available CompTIA PenTest+ PT0-003 exam objectives (Exam objectives V3, document version 5.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.