Open navigation menu
Close suggestions
Search
Search
en
Change Language
Upload
Sign in
Sign in
Download free for days
0 ratings
0% found this document useful (0 votes)
159 views
92 pages
Module 4 Enumeration
Uploaded by
Nghia Tran Van
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content,
claim it here
.
Available Formats
Download as PDF or read online on Scribd
Download now
Download
Save Module 4 Enumeration For Later
Download
Save
Save Module 4 Enumeration For Later
0%
0% found this document useful, undefined
0%
, undefined
Embed
Share
Print
Report
0 ratings
0% found this document useful (0 votes)
159 views
92 pages
Module 4 Enumeration
Uploaded by
Nghia Tran Van
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content,
claim it here
.
Available Formats
Download as PDF or read online on Scribd
Download now
Download
Save Module 4 Enumeration For Later
Carousel Previous
Carousel Next
Download
Save
Save Module 4 Enumeration For Later
0%
0% found this document useful, undefined
0%
, undefined
Embed
Share
Print
Report
Download now
Download
You are on page 1
/ 92
Search
Fullscreen
Module 04: EnumerationEthical Hacking and Countermeasures ‘eam 31250 Cerfied thea ker Enumeration Module Objectives ¢ |EH o Understanding Enumeration Concepts . Understanding bier Tues fr He Eurersion Understanding offerent Techniques fr SAM and LDAP Enumeration ‘ 2p Une ee es Pan WS reten Understanding Other Enumeration such 5 Pec, VI, RPC, Lnuy/Uns,Tlet, FT, TER, SMB Understanding Otter Enumeration Countermeasures Module Objectives In the previous modules, you learned about footprinting and network scanning. This module covers the next phase, enumeration. We start with an introduction to enumeration concepts. Subsequently, the module provides insight into different techniques for Network Basic Input/Output System (NetBIOS), Simple Network Management Protocol (SNMP), Lightweight Directory Access Protocol (LDAP), Network Time Protocol (NTP), Network File System (NFS), ‘Simple Mail Transfer Protocol (SMTP), Domain Name System (DNS), Internet Protocol Security (IPsec), Voice over Internet Protocol (VoIP), remote procedure call (RPC), Linux/Unix, Telnet, File Transfer Protocol (FTP), Trivial FTP (TFTP), Server Message Block (SMB), Internet Protocol version 6 (|Pv6), and Border Gateway Protocol (BGP) enumeration. The module ends with an overview of ‘enumeration countermeasures. At the end of this module, you will be able to: Describe enumeration concepts "Explain different techniques for NetBIOS enumeration "Explain different techniques for SNMP enumeration "Explain different techniques for LDAP enumeration Explain different techniques for NTP enumeration Explain different techniques for NFS enumeration Explain different techniques for SMTP and DNS enumeration Explain other enumeration techniques such as IPsec, VoIP, RPC, Linux/Unix, Telnet, FTP, TFTP, SMB, IPv6, and BGP enumeration = Apply enumeration countermeasures Module 04 Page 292 Ethical Making and Countermeasures Copyright © by E-Cauncil ‘Al Rights Reserved. Reproduction Sel ProhiatedEthical Hacking and Countermeasures Enumeration ‘eam 31250 Cerfied thea ker Module Flow Enumeration Concepts NetBIOS Enumeration SNMP Enumeration LDAP Enumeration | | © reper smamension | | | © srr ss ns esameratin | | Je oases | | Jo ricinus coiniasens | Enumeration Concepts Inthe enumeration phase, attackers enumerate usernames and other information on the groups, network shares, and services of networked computers. This information helps attackers identify vulnerabilities in the target network and exploit them to hack the system. Different sections of this module deal with the enumeration of different services and ports. Before discussing the actual enumeration process, we introduce concepts related to ‘enumeration. ‘Module 04 Page 252 Ethical Making and Countermeasures Copyright © by E-Cauncil ‘Al Rights Reserved. Reproduction Sel ProhiatedEthical Hacking and Countermeasures ‘eam 31250 Cerfied thea ker Enumeration 3 3 | What is Enumeration? CEH Taformation Ennmaarasoa hy Zatraders (©. Enuperaton moines atacter esting sive ‘connections with atargt system and performing $B) ketwork resources (Grocid quia te pin more ntoraion atthe target ch Network shares ee Routing abies |G Arrackers use the extracted information to identify Dots fora eystem attack and perform password Aut and service etings tacks to gain unadthorzee access to nformation system resources HB sump ana aon dette 5] _ machine names |. Enumeration techniques are conducted in an intranet B. Vers and groups ‘environment ()_Apptetions ane banners What is Enumeration? Enumeration is the process of extracting usernames, machine names, network resources, shares, and services from a system or network. In the enumeration phase, an attacker creates active connections with the system and sends directed queries to gain more information about the target. The attacker uses the information collected using enumeration to identify vulnerabilities in the system security, which help them exploit the target system. In turn, enumeration allows the attacker to perform password attacks to gain unauthorized access to information system resources. Enumeration techniques work in an intranet environment. In particular, enumeration allows the attacker to collect the following information: Network resources = SNIMP and fully quali (FQDN) details "Machine names ied domain name = Network shares "Routing tables Audit and service settings * Users and groups "Applications and banners During enumeration, attackers may stumble upon a remote inter-process communication (IPC) share, such as IPC$ in Windows, which they can probe further to connect to an administrative share by brute-forcing admin credentials and obtain complete information about the file-system listing that the share represents. The previous modules highlighted how attackers gather necessary information about a target without any illegal activity. However, enumeration activities may be illegal depending on the ‘organization's policies and the laws that are in effect. An ethical hacker or pen tester should always acquire proper authorization before performing enumeration. ‘Module 04 Page 293 Ethical Making and Countermeasures Copyight © by E-Caunedl ‘Al Rights Reserved. Reproduction Sel ProhiatedEthical Hacking and Countermeasures ‘eam 31250 Cerfied thea ker toumesnon ; | Techniques for Enumeration CEH Extract usernames using pe Extract information using OF email IDs. default passwords: zs cst see 2 Selsmmmiio Fejaemonle ienaous SB same Techniques for Enumeration The following techniques are used to extract information about a target. Extract usernames using email IDs Every email address contains two parts, a username and a domain name, in the format “username@domainname.” Extract information using default passwords Many online resources provide a list of default passwords assigned by manufacturers to their products. Users often ignore recommendations to change the default usernames and passwords provided by the manufacturer or developer of a product. This eases an attacker's task of enumerating and exploiting the target system. Brute force Active Directory Microsoft Active Directory is susceptible to username enumeration at the time of user- supplied input verification. This is a design error in the Microsoft Active Directory implementation. If a user enables the "logon hours” feature, then all the attempts at service authentication result in different error messages. Attackers take advantage of this, to enumerate valid usernames. An attacker who succeeds in extracting valid usernames can conduct a brute-force attack to crack the respective passwords. Extract information using DNS Zone Transfer ‘A network administrator can use DNS zone transfer to replicate DNS data across several DNS servers or back up DNS files. For this purpose, the administrator needs to execute a specific zone-transfer request to the name server. If the name server permits zone Module 04 Page 284 Ethical Making and Countermeasures Copyright © by E-Cauncil ‘Al Rights Reserved. Reproduction Sel ProhiatedEthical Hacking and Countermeasures ‘eam 31250 Cerfied thea ker Enumeration transfer, it will convert all the DNS names and IP addresses hosted by that server to ASCII text. If the network administrators did not configure the DNS server properly, the ONS zone transfer can be an effective method to obtain information about the organization's network. This information may include lists of all named hosts, sub-zones, and related IP addresses. A user can perform DNS zone transfer using nslookup and dig commands. Extract user groups from Windows To extract user groups from Windows, the attacker should have a registered ID as a user in the Active Directory. The attacker can then extract information from groups in which the user is a member by using the Windows interface or command-line method. "Extract usernames using SNMP Attackers can easily guess read-only or read-write community strings by using the SNMP. application programming interface (API) to extract usernames. ‘Module 04 Page 295 Ethical Making and Countermeasures Copyright © by E-Cauncil ‘Al Rights Reserved. Reproduction Sel Prohiated
You might also like
Eh Unit 3
PDF
No ratings yet
Eh Unit 3
77 pages
Unit-3 Enumeration and Port Scanning
PDF
No ratings yet
Unit-3 Enumeration and Port Scanning
39 pages
CEH v12 - Module13@nettrain
PDF
No ratings yet
CEH v12 - Module13@nettrain
110 pages
Module 20 Cryptography
PDF
No ratings yet
Module 20 Cryptography
124 pages
Module 16 Hacking Wireless Networks
PDF
No ratings yet
Module 16 Hacking Wireless Networks
209 pages
Module 11 Session Hijacking
PDF
No ratings yet
Module 11 Session Hijacking
86 pages
Module 8 Sniffing
PDF
No ratings yet
Module 8 Sniffing
121 pages
Module 9 Social Engineering
PDF
No ratings yet
Module 9 Social Engineering
83 pages
OSINT for ICS_OT - Review Questions
PDF
No ratings yet
OSINT for ICS_OT - Review Questions
17 pages
CEHv12 EC Council
PDF
No ratings yet
CEHv12 EC Council
24 pages
CEH v12 Lesson 4 - NTP, DNS & Other Network en
PDF
No ratings yet
CEH v12 Lesson 4 - NTP, DNS & Other Network en
83 pages
Module 6 System Hacking
PDF
100% (1)
Module 6 System Hacking
291 pages
Module 3 Scanning Networks
PDF
No ratings yet
Module 3 Scanning Networks
154 pages
Nmap_ The Complete Guide From Beginner to Advanced
PDF
No ratings yet
Nmap_ The Complete Guide From Beginner to Advanced
13 pages
Module 10 Denial of Service
PDF
No ratings yet
Module 10 Denial of Service
91 pages
Module 1 Introduction To Ethical Hacking
PDF
No ratings yet
Module 1 Introduction To Ethical Hacking
91 pages
Module 13 Hacking Web Server
PDF
100% (1)
Module 13 Hacking Web Server
117 pages
Module 12 Evading IDS Firewall and Honeybots
PDF
No ratings yet
Module 12 Evading IDS Firewall and Honeybots
136 pages
Windows Exploitation - Msbuild PDF
PDF
No ratings yet
Windows Exploitation - Msbuild PDF
18 pages
Internship Report
PDF
No ratings yet
Internship Report
31 pages
Nmap Cheat Sheet From Discovery To Exploits - Part 1 Introduction To Nmap
PDF
No ratings yet
Nmap Cheat Sheet From Discovery To Exploits - Part 1 Introduction To Nmap
19 pages
3.scanning Network
PDF
No ratings yet
3.scanning Network
25 pages
Udemy - Web Pentesting Course Slides
PDF
100% (1)
Udemy - Web Pentesting Course Slides
103 pages
Ccna S 2.0
PDF
No ratings yet
Ccna S 2.0
116 pages
Lab 2 - Port and Service Discovery
PDF
No ratings yet
Lab 2 - Port and Service Discovery
38 pages
Understanding AD Enumeration
PDF
No ratings yet
Understanding AD Enumeration
101 pages
SEC201.2 Linux Fundamentals
PDF
No ratings yet
SEC201.2 Linux Fundamentals
213 pages
Ben's Security+ Notes
PDF
No ratings yet
Ben's Security+ Notes
22 pages
Cisco - Cybersecurity.pass4sure.200 201.v2020!06!26.by - Silva.60q
PDF
No ratings yet
Cisco - Cybersecurity.pass4sure.200 201.v2020!06!26.by - Silva.60q
50 pages
EC-Council - CEHv8 Module 17 Evading IDS, Firewalls, and Honeypots Slide 2013
PDF
No ratings yet
EC-Council - CEHv8 Module 17 Evading IDS, Firewalls, and Honeypots Slide 2013
142 pages
Web 200 Syllabus
PDF
No ratings yet
Web 200 Syllabus
11 pages
212-82 Updated Exam Dumps Questions
PDF
No ratings yet
212-82 Updated Exam Dumps Questions
15 pages
Conf2015 - MGough - Malware Logs Archaelogy - SecurityCompl - AdvnAttacks Splunk PDF
PDF
No ratings yet
Conf2015 - MGough - Malware Logs Archaelogy - SecurityCompl - AdvnAttacks Splunk PDF
62 pages
Windows Security Event Logs Cheatsheet
PDF
No ratings yet
Windows Security Event Logs Cheatsheet
8 pages
Hands-On Ethical Hacking and Network Defense
PDF
No ratings yet
Hands-On Ethical Hacking and Network Defense
41 pages
CEH v9 Notes
PDF
No ratings yet
CEH v9 Notes
39 pages
My CEHpractica Lcheat Sheet
PDF
No ratings yet
My CEHpractica Lcheat Sheet
6 pages
312 50v12
PDF
No ratings yet
312 50v12
4 pages
my notes
PDF
No ratings yet
my notes
4 pages
CEH Master Brochure
PDF
No ratings yet
CEH Master Brochure
14 pages
Wireshark Tutorial Identifying Hosts
PDF
No ratings yet
Wireshark Tutorial Identifying Hosts
13 pages
Breakthroughs For Defenders: Stellar Cyber's XDR Kill Chain - Delivering The Promise of EVERTHING Detection and Response
PDF
No ratings yet
Breakthroughs For Defenders: Stellar Cyber's XDR Kill Chain - Delivering The Promise of EVERTHING Detection and Response
4 pages
Nessus-Nmap Lab: IST 451 - Network Security
PDF
No ratings yet
Nessus-Nmap Lab: IST 451 - Network Security
6 pages
Mayur Kumar Jain - (Resume)
PDF
No ratings yet
Mayur Kumar Jain - (Resume)
3 pages
Session Hijacking
PDF
No ratings yet
Session Hijacking
50 pages
By Gopalsamy Rajendran
PDF
No ratings yet
By Gopalsamy Rajendran
19 pages
11 Mwri A Penetration Testers Guide To The Azure Cloud v1.2
PDF
No ratings yet
11 Mwri A Penetration Testers Guide To The Azure Cloud v1.2
57 pages
Thor / Spark Log Analysis: Version 1.0, November 2017 Florian Roth, Nextron Systems GMBH
PDF
No ratings yet
Thor / Spark Log Analysis: Version 1.0, November 2017 Florian Roth, Nextron Systems GMBH
41 pages
CCT Battle Card
PDF
No ratings yet
CCT Battle Card
2 pages
© 2018 Caendra, Inc. - Hera For PTP - SNMP Analysis
PDF
No ratings yet
© 2018 Caendra, Inc. - Hera For PTP - SNMP Analysis
13 pages
SMB Enumeration
PDF
100% (1)
SMB Enumeration
23 pages
Up-To-Date 312-50 Eccouncil Certified Ethical Hacker v10 (2019) PDF Exam Demo
PDF
No ratings yet
Up-To-Date 312-50 Eccouncil Certified Ethical Hacker v10 (2019) PDF Exam Demo
5 pages
Lab - Capture The Flag - SickOS 1.1
PDF
No ratings yet
Lab - Capture The Flag - SickOS 1.1
9 pages
Certified Ethical Hacker Ceh Crash Course
PDF
No ratings yet
Certified Ethical Hacker Ceh Crash Course
2 pages
Network and Security: Assignment
PDF
No ratings yet
Network and Security: Assignment
9 pages
Firewall Lab
PDF
No ratings yet
Firewall Lab
3 pages
Ec-Council - Iclass: Incident Handling and Response Track
PDF
No ratings yet
Ec-Council - Iclass: Incident Handling and Response Track
1 page
CEH Notes
PDF
No ratings yet
CEH Notes
12 pages
Lab 1 - Footprinting Using NIKTO and Theharvester
PDF
No ratings yet
Lab 1 - Footprinting Using NIKTO and Theharvester
2 pages
Lab Experiment #08 - Network & Host Detection Scans
PDF
No ratings yet
Lab Experiment #08 - Network & Host Detection Scans
3 pages