Week 4

Ethical Hacking Week 5: The Art of Target Enumeration 🕵️‍♂️🔍

This week in Ethical Hacking and Penetration Testing, we moved into Enumeration—the intrusive phase where we actively communicate with targets to extract actionable intelligence like network shares, usernames, and passwords.

The Core of Windows Enumeration: NetBIOS

Because many attacks on older Windows systems still work today, enumerating Microsoft targets is a major focus. To do this, you must understand NetBIOS (Network Basic Input Output System).

• NetBIOS Names: These are limited to 16 characters and must be unique on the network. The final character is a hex suffix that identifies the specific service running.
  • <00>: Workstation service
  • <20>: Server service (sharing enabled)
  • <1C>: Domain Controller or IIS
• Null Sessions: An infamous, unauthenticated connection to a Windows system that doesn't require a username or password. Surprisingly, it still exists on systems like Windows XP!

The Enumeration Toolkit 🧰

We covered a mix of command-line and GUI tools used to pull this data directly from targets:

Command-Line Essentials

• nbtscan: Scans a range of IP addresses for NetBIOS information.
• nbtstat: Displays the NetBIOS table of a remote machine.
• net view: Checks for shared resources on a specific network host.
• net use: Connects to those shared folders or files.

GUI & Advanced Tools

• NetScan Tools Pro: Graphically maps NetBIOS services and verifies access to shared resources.
• DumpSec: Connects to a server to "dump" detailed permissions, user tables, policies, and registry details.
• Hyena: A management tool that visually maps shares, user logins, and terminal services.
• Nessus Client: A heavy hitter that identifies OS versions, open shares, and even firewall vulnerabilities across large networks.

Beyond Windows

While NetBIOS is the star of the show for Windows, we also briefly explored service enumeration tools for other protocols, including Amap, Httprint, Httsquash, and Ike-scan.

Wrapping Up

Enumeration transitions us from passively "looking" at a target to actively "touching" it, giving us the exact keys we need for exploitation. Next week, we dive into Vulnerability Mapping!