Extracting user names and share names through active connections is:
Enumeration
What enumeration extracts and why it matters, NetBIOS, SNMP, LDAP, NTP and DNS enumeration, the ports and services to know, NULL sessions, and UNIX/Linux enumeration commands.
How to read this page
Every original slide is shown unchanged. Yellow marks on a slide point to a numbered note: hover or tap a mark to jump to its note, and hover a note to see its marks. Questions tagged Past exam appeared on a real paper; Prediction questions are likely angles, not confirmed. Pick an answer to each question: a wrong pick tells you why it is wrong, so you can try again.
All 26 slides
- 1 Slide 1
- 2 Key Concepts
- 3 Enumeration in Ethical Hacking
- 4 Enumeration can be used to gather any of the following
- 5 Why Is Enumeration Important?
- 6 Enumeration
- 7 Enumeration Classification
- 8 Slide 8
- 9 1- NetBIOS Enumeration
- 10 § If an attacker finds a Windows OS with port 139 open, he or
- 11 NetBIOS names and suffixes
- 12 NetBIOS Enumeration
- 13 2- SNMP
- 14 SNMP contains two passwords that you can use for configuring as well as for accessing the SNMP agent from the management station.
- 15 Slide 15
- 16 SNMP Enumeration Tools
- 17 3- LDAP Enumeration
- 18 4- NTP Enumeration
- 19 5- DNS Enumeration
- 20 Techniques for Enumeration
- 21 Slide 21
- 22 Ports and services to know about
- 23 NULL Session
- 24 NULL Session (Cont.)
- 25 Using the srvinfo command, the target will return its operating system type to us. For a full listing of query commands, you can use the rpcclient --help command.
- 26 6- UNIX/Linux Enumeration Commands
Slide 1
Key Concepts
Enumeration in Ethical Hacking
Notes
Enumeration: active connections to the target to extract usernames, machine names, shares, services, groups. Happens after scanning.
Exam angle
Enumeration can be used to gather any of the following
Why Is Enumeration Important?
Enumeration
Enumeration Classification
Slide 8
1- NetBIOS Enumeration
Notes
NetBIOS (UDP 137, 138, TCP 139): 16-character names; the 16th character is the service suffix (e.g. <20> file server).
Exam angle
NetBIOS names are how many characters long?
§ If an attacker finds a Windows OS with port 139 open, he or
NetBIOS names and suffixes
NetBIOS Enumeration
2- SNMP
Notes
SNMP (UDP 161/162) uses community strings: "public" (read) and "private" (read/write) by default.
Trap Default community strings public/private are a classic misconfiguration.
Exam angle
SNMP’s default read-only community string is:
SNMP contains two passwords that you can use for configuring as well as for accessing the SNMP agent from the management station.
Slide 15
SNMP Enumeration Tools
3- LDAP Enumeration
4- NTP Enumeration
5- DNS Enumeration
Notes
DNS zone transfer (TCP 53, AXFR) dumps every record of a zone if not restricted.
Exam angle
A DNS zone transfer uses:
Techniques for Enumeration
Slide 21
Ports and services to know about
Notes
Ports to know: 21 FTP, 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 80 HTTP, 110 POP3, 135 RPC, 137–139 NetBIOS, 161 SNMP, 389 LDAP, 443 HTTPS, 445 SMB, 3389 RDP.
NULL Session
Notes
NULL session: an anonymous connection to IPC$ with empty user and password (net use \\target\IPC$ "" /u:"") that leaks user and share lists.
Exam angle
A NULL session connects to which share?
NULL Session (Cont.)
Using the srvinfo command, the target will return its operating system type to us. For a full listing of query commands, you can use the rpcclient --help command.
6- UNIX/Linux Enumeration Commands
Notes
UNIX/Linux: finger, rpcinfo, showmount, rusers, enum4linux.