Offensive Security and Ethical Hacking
Network Penetration Testing: Scanning and Enumeration
Scanning and enumeration constitute the critical reconnaissance phase of a penetration test, allowing an auditor to map the network topology and identify accessible services. Understanding this process is vital because it reveals the attack surface and potential entry points before any exploitation attempts occur. You reach for these techniques immediately after initial scoping to transform a blind target into a mapped environment filled with actionable vulnerabilities.
Host Discovery with ICMP and TCP
Host discovery is the foundational step in identifying which devices are active on a network segment. It works by sending probes to determine if a target is reachable, typically leveraging ICMP echo requests or TCP SYN packets. The logic here is simple: if a target responds, it is 'up.' In modern environments, firewalls often drop ICMP packets, so we must rely on TCP SYN scans to ports like 80 or 443 to gauge host activity, as these are rarely blocked. By observing the responses—or lack thereof—we build an inventory of the attack surface. This phase is not about finding vulnerabilities, but about narrowing our scope to avoid wasting time on non-existent hosts. Understanding this allows you to reason about stealth; excessive scanning triggers IDS, so balancing speed with noise is key when identifying live systems without being detected by security operations teams.
# Using nmap to discover hosts on a subnet
# -sn disables port scanning, acting like a ping sweep
# 192.168.1.0/24 targets the entire class C range
nmap -sn 192.168.1.0/24 -oG discovery_results.txtTCP Port Scanning Mechanics
Once hosts are identified, we perform port scanning to identify services listening for connections. A standard TCP connect scan completes the three-way handshake, making it very reliable but noisy. Alternatively, the SYN scan (stealth scan) sends a SYN packet and waits for a SYN/ACK; it never completes the handshake, reducing the footprint in logs. The reason this works is due to the underlying TCP protocol implementation: if the port is open, the stack sends a SYN/ACK; if closed, it sends an RST. By analyzing these flags, we determine the status of the port without necessarily establishing a full session. This is critical for security professionals because it maps exactly which software components are accessible. You must reason about how stateful firewalls handle these packets; sometimes an open port will appear 'filtered' because an intermediary device is dropping the return traffic, which gives you a hint about network architecture.
# Perform a SYN scan on common ports
# -sS triggers the stealthy half-open scan
# --top-ports 100 scans only the most common service ports
nmap -sS -T4 --top-ports 100 192.168.1.5Service Version Detection
Knowing a port is open is insufficient; we must identify the specific service and version running behind that port. This works by sending unique probes to an open port and analyzing the resulting banner or protocol-specific response. For example, an HTTP server responds with headers revealing its software version, while an SSH server identifies its protocol and underlying library. This is vital because vulnerabilities are often version-specific; a service might be secure in one release and critically flawed in the next. By performing version detection, you move from knowing 'there is a web server' to knowing 'there is an Apache 2.4.49 web server,' which is actionable intelligence. Reasoning through this, you realize that accuracy relies on having a database of signatures to compare incoming responses against, which is why your scanning tools must be regularly updated to recognize newer, obscure software releases.
# -sV enables version detection
# This sends probes to identify the software behind the port
nmap -sV -p 80,443,22 192.168.1.5SMB Enumeration on Windows Targets
Enumeration is the process of extracting detailed information from a discovered service. In a Windows environment, the Server Message Block (SMB) protocol is a primary target. SMB allows for file and printer sharing, but if configured poorly, it allows an unauthenticated user to pull usernames, shares, and password policies. The mechanism behind this relies on Null Session connections—a feature intended for initial network discovery that often fails to enforce authentication. By attempting to list network shares without credentials, we can often map out the file structure of a server, identifying sensitive directories or configuration files that might contain credentials. Reasoning about SMB security requires understanding that it is a legacy protocol; even when hardened, it provides massive metadata about the domain structure, which helps an attacker understand the user hierarchy and identify high-value targets within the internal network infrastructure.
# Use enum4linux to extract info from SMB
# -U pulls user lists, -S pulls share information
enum4linux -U -S 192.168.1.10Banner Grabbing and Protocol Interaction
Banner grabbing is a manual enumeration technique that involves interacting directly with a service to extract identification strings. While automated tools provide speed, manual interaction is essential when services use non-standard ports or wrap their traffic in encryption. By using a basic network utility to connect to an open port, we can force the application to 'introduce itself' before we provide any valid credentials. This works because most network services are configured to provide a greeting or prompt upon connection. This is the ultimate fallback technique; if a scanner fails, a direct network interaction will succeed. Reasoning through this, you see that you are essentially acting as a legitimate client to trick the server into leaking its metadata. This level of interaction is the bridge between scanning and the exploitation phase, as it provides the exact context needed to tailor a specific exploit package against the target.
# Connect manually to a port to grab the service banner
# This works for any text-based service like SMTP or FTP
echo "" | nc -v 192.168.1.5 21Key points
- Host discovery is the first step in mapping the network environment for potential targets.
- TCP SYN scans offer a balance between speed and stealth by not completing the full handshake.
- Service version detection is necessary to identify specific, exploitable software releases.
- SMB enumeration often leverages misconfigured Null Sessions to map sensitive internal resources.
- Banner grabbing is a manual, essential method for identifying services on non-standard ports.
- Firewalls can influence scan results by creating a filtered status rather than an open or closed one.
- Efficient scanning requires balancing the need for data against the risk of triggering security alerts.
- Enumeration transforms raw port data into actionable intelligence for the exploitation phase.
Common mistakes
- Mistake: Performing aggressive scans on production systems without authorization. Why it's wrong: Aggressive scanning can crash fragile legacy services or trigger DDoS-like load conditions. Fix: Always verify the scope and use throttled, stealthy scanning techniques in production environments.
- Mistake: Over-relying on automated vulnerability scanners without manual verification. Why it's wrong: Scanners often produce false positives or miss context-dependent vulnerabilities. Fix: Treat scanner output as a starting point and manually validate findings before reporting.
- Mistake: Ignoring ICMP/Ping as the primary host discovery method. Why it's wrong: Most modern firewalls and hardened hosts drop ICMP packets, leading to missed targets. Fix: Use multi-protocol discovery including ARP, TCP SYN/ACK, and UDP scans.
- Mistake: Failing to perform service enumeration after identifying open ports. Why it's wrong: Just knowing a port is open doesn't tell you the version or potential vulnerabilities present. Fix: Perform banner grabbing and use service-specific scripts to identify exact versions and configurations.
- Mistake: Neglecting the UDP scanning process. Why it's wrong: Many critical services like DNS, SNMP, and DHCP run on UDP, which is often overlooked by quick TCP-only scans. Fix: Always include a targeted UDP sweep of common ports as part of the reconnaissance phase.
Interview questions
What is the primary objective of the scanning and enumeration phase in a network penetration test?
The primary objective of the scanning and enumeration phase is to build a detailed inventory of the target environment to identify potential attack vectors. After initial reconnaissance, we use scanning to determine which hosts are live, what operating systems they run, and which network services are exposed. Enumeration then takes this a step further by actively querying those services to extract specific information like usernames, software versions, or configuration details. This phase is critical because it moves the tester from knowing that a network exists to understanding exactly how to interact with its components to find vulnerabilities for subsequent exploitation.
What is the difference between TCP Connect scanning and SYN stealth scanning?
TCP Connect scanning, or 'full-open' scanning, completes the three-way handshake by sending a SYN packet, receiving a SYN-ACK, and responding with an ACK packet. It is reliable but easily logged by firewalls and intrusion detection systems. In contrast, SYN stealth scanning, or 'half-open' scanning, sends only a SYN packet; if a SYN-ACK is received, the scanner immediately sends an RST packet to tear down the connection before it is fully established. SYN scanning is generally faster and significantly harder to detect, making it the preferred choice for stealthy reconnaissance where you want to minimize your footprint on the target logs.
How would you perform service enumeration on a target that has port 445 open?
Port 445 typically indicates the presence of SMB, which is a goldmine for information. I would use tools like enum4linux or nmap scripts to enumerate the target. I would specifically look for the server's OS version, current shares, and, most importantly, if null sessions or guest access are enabled. Command-wise, I might use 'enum4linux -a <target_ip>' to pull system information, user lists, and group policies. If I can list shares, I would then attempt to identify if any sensitive files are accessible without authentication, which often leads to deeper access or credentials that can be leveraged for lateral movement within the network.
Compare active scanning and passive traffic analysis for network discovery.
Active scanning involves sending packets directly to targets, such as using nmap to probe ports, which is highly efficient for gathering specific information but is 'noisy' and likely to be detected by security appliances or logged by the target hosts. Passive traffic analysis, conversely, involves sniffing network traffic using tools like tcpdump or Wireshark to observe packets without injecting any traffic into the network. Passive analysis is completely stealthy and provides a natural view of device behavior, but it is limited by what traffic happens to be traversing the segment you are monitoring, making it slower and potentially incomplete compared to active techniques.
How do you handle host discovery in a network environment where ICMP is blocked?
When ICMP echo requests are blocked, the standard 'ping' command will fail to identify live hosts, so I must switch to alternative transport layer techniques. I typically use ARP scanning on local subnets, which bypasses ICMP entirely by relying on Layer 2 addresses. If I am remote, I would use TCP SYN scanning against common ports like 80, 443, or 22, or perform a UDP scan against common service ports. By analyzing the responses—or the lack of ICMP unreachable messages—I can infer the existence of a host even when the standard ping utility provides no feedback.
Explain the process of banner grabbing and why it is a vital step in enumeration.
Banner grabbing is the technique of capturing the response header sent by a service when a connection is initiated. By connecting to an open port via netcat—for example, 'nc -v <target> 80'—the server often returns information about the software name and exact version number. This is vital because security is often version-dependent. If I identify an outdated version of an FTP server, for instance, I can immediately cross-reference that specific version against known public vulnerability databases to find a pre-written exploit. Without this enumeration, I would be guessing at potential vulnerabilities rather than conducting a targeted and efficient assessment.
Check yourself
1. When scanning a network, you notice that a specific target is not responding to ICMP echo requests but shows several open TCP ports in an Nmap scan. What is the most accurate conclusion?
- A.The host is down and the open ports are ghost entries in the routing table.
- B.The host is likely protected by a firewall that blocks ICMP traffic but allows specific TCP traffic.
- C.The network interface card on the target is failing and dropping non-TCP packets.
- D.The scanner is misconfigured and must be reset to use UDP instead.
Show answer
B. The host is likely protected by a firewall that blocks ICMP traffic but allows specific TCP traffic.
Option 2 is correct because firewalls commonly drop ICMP to reduce visibility while allowing necessary traffic like HTTP/HTTPS. Option 1 is incorrect because if TCP ports respond, the host is clearly up. Option 3 is speculative and unlikely. Option 4 is incorrect because TCP scanning is valid regardless of ICMP settings.
2. Which of the following describes why performing a 'TCP Connect' scan is generally considered more intrusive than a 'TCP SYN' scan?
- A.TCP Connect scans are faster and cause less network congestion than SYN scans.
- B.TCP Connect scans require administrative privileges, making them more suspicious to auditors.
- C.TCP Connect scans complete the three-way handshake, creating more logs on the target system.
- D.TCP Connect scans utilize stealthy spoofed IP addresses to bypass security controls.
Show answer
C. TCP Connect scans complete the three-way handshake, creating more logs on the target system.
Option 3 is correct because a full handshake is logged by most applications and OS audit logs. Option 1 is wrong because SYN scans are faster. Option 2 is wrong because SYN scans usually require higher privileges (raw sockets). Option 4 is wrong because neither scan technique inherently uses spoofing.
3. During service enumeration, you discover a service responding on port 445. What is the most effective next step?
- A.Run an aggressive Nmap OS fingerprinting scan to crash the service.
- B.Attempt to list available network shares using null authentication.
- C.Immediately launch a brute-force attack against the root user.
- D.Scan all UDP ports to verify if the service exists on non-standard ports.
Show answer
B. Attempt to list available network shares using null authentication.
Option 2 is correct as port 445 (SMB) is known for information leakage. Option 1 is reckless and can crash services. Option 3 is poor practice without reconnaissance. Option 4 is inefficient as port 445 is standard for SMB over TCP.
4. Why is banner grabbing sometimes insufficient for accurately identifying a network service?
- A.Banner grabbing only works if the target uses an encrypted connection.
- B.Banners are static strings that can be easily modified or obfuscated by administrators.
- C.Banner grabbing requires the target to have an active web interface.
- D.Banners are only generated by hardware routers and not by software applications.
Show answer
B. Banners are static strings that can be easily modified or obfuscated by administrators.
Option 2 is correct; service banners can be changed in configuration files to mislead scanners. Option 1 is false (it works for plaintext). Option 3 is false (all network services can show banners). Option 4 is false (software services generate banners).
5. When scanning a target that employs a 'Port Knocking' security mechanism, which behavior would a standard port scanner observe?
- A.The host appears to have no open ports until the specific sequence is executed.
- B.The host responds immediately to all probes, revealing its internal firewall rules.
- C.The scanner successfully detects all ports but marks them as 'filtered' indefinitely.
- D.The scanner triggers a system-wide shutdown due to the suspicious activity.
Show answer
A. The host appears to have no open ports until the specific sequence is executed.
Option 0 is correct; port knocking hides services until a secret handshake of packets is received. Option 1 is wrong because the host remains hidden. Option 2 is wrong because ports are not 'filtered' until the knock, and Option 3 is hyperbolic.