Scanning & Enumeration Complete Guide

Introduction to Scanning & Enumeration

Scanning → Identifying live hosts, open ports, and services.
Enumeration → Extracting detailed info (users, shares, services, banners).

📚 Nmap Tools Guide

A Complete Network scanning guide about one of the Best Network scanner Tools — Nmap with Practical experience

🛒 Buy Now on Amazon

Key Objectives

• Discover network topology (devices, firewalls, routers)
• Identify vulnerable services (misconfigurations, outdated software)
• Gather user accounts, shares, and system data for exploitation

Scanning Techniques & Types

A. Host Discovery (Finding Live Systems)

Ping Sweep — Checks which IPs respond to ICMP

nmap -sn 192.168.1.0/24

ARP Scanning — Local network, bypasses firewalls

arp-scan -l

B. Port Scanning (Finding Open Ports)

C. Service & OS Detection

Banner Grabbing — Identifies service versions

nc -nv 192.168.1.1 80

OS Fingerprinting — Detects OS via TCP/IP stack

nmap -O 192.168.1.1

D. Vulnerability Scanning

Nmap NSE Scripts — Automated exploit checks

nmap --script vuln 192.168.1.1

• Nessus/OpenVAS — Comprehensive vulnerability assessment

Enumeration Techniques

A. NetBIOS Enumeration (Windows Networks)

• Finds shares, users, groups

nmblookup -A 192.168.1.1
nbtscan 192.168.1.0/24

B. SNMP Enumeration

• Extracts device info, configs via SNMP

snmpwalk -c public -v1 192.168.1.1

C. LDAP Enumeration

• Queries Active Directory users, groups

ldapsearch -x -h 192.168.1.1 -b "dc=example,dc=com"

D. SMB Enumeration

• Lists shares, users, permissions

smbclient -L //192.168.1.1
enum4linux -a 192.168.1.1

E. DNS Enumeration

• Extracts DNS records, subdomains, mail servers

dnsrecon -d example.com

Advanced Scanning & Evasion

A. Firewall Evasion Techniques

• Fragmenting Packets — -f in Nmap
• Decoy Scanning — Hide among fake IPs

nmap -D RND:10 192.168.1.1

• Timing Adjustments — -T0 slow, -T5 aggressive

B. Proxy & VPN Scanning

• Use Proxychains to anonymize scans

proxychains nmap -sT 192.168.1.1

Hands-On Lab Exercises

Exercise 1: Basic Network Scan

nmap -sS -p 1-1000 -A 192.168.1.1

• Interpret results: Open ports, services, OS

Exercise 2: SMB Enumeration

enum4linux -a 192.168.1.1

• Find: Shares, users, password policies

Exercise 3: Vulnerability Scanning

nmap --script vuln 192.168.1.1

• Check for: Heartbleed, Shellshock, misconfigurations

Countermeasures

📚 Nmap Tools Guide

A Complete Network scanning guide about one of the Best Network scanner Tools — Nmap with Practical experience

🛒 Buy Now on Amazon

Tools Summary

Next Steps

• Proceed to Module 4: System Hacking & Exploitation (password cracking, privilege escalation)
• Practice on Hack The Box (HTB) / TryHackMe (THM)