Open navigation menu
Close suggestions
Search
Search
en
Change Language
Upload
Sign in
Sign in
Download free for days
0 ratings
0% found this document useful (0 votes)
148 views
Module 4 Enumeration
Uploaded by
Nghia Tran Van
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content,
claim it here
.
Available Formats
Download as PDF or read online on Scribd
Download now
Download
Save Module 4 Enumeration For Later
Download
Save
Save Module 4 Enumeration For Later
0%
0% found this document useful, undefined
0%
, undefined
Embed
Share
Print
Report
0 ratings
0% found this document useful (0 votes)
148 views
Module 4 Enumeration
Uploaded by
Nghia Tran Van
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content,
claim it here
.
Available Formats
Download as PDF or read online on Scribd
Download now
Download
Save Module 4 Enumeration For Later
Carousel Previous
Carousel Next
Save
Save Module 4 Enumeration For Later
0%
0% found this document useful, undefined
0%
, undefined
Embed
Share
Print
Report
Download now
Download
You are on page 1
/ 92
Search
Fullscreen
Module 04: EnumerationEthical Hacking and Countermeasures ‘eam 31250 Cerfied thea ker Enumeration Module Objectives ¢ |EH o Understanding Enumeration Concepts . Understanding bier Tues fr He Eurersion Understanding offerent Techniques fr SAM and LDAP Enumeration ‘ 2p Une ee es Pan WS reten Understanding Other Enumeration such 5 Pec, VI, RPC, Lnuy/Uns,Tlet, FT, TER, SMB Understanding Otter Enumeration Countermeasures Module Objectives In the previous modules, you learned about footprinting and network scanning. This module covers the next phase, enumeration. We start with an introduction to enumeration concepts. Subsequently, the module provides insight into different techniques for Network Basic Input/Output System (NetBIOS), Simple Network Management Protocol (SNMP), Lightweight Directory Access Protocol (LDAP), Network Time Protocol (NTP), Network File System (NFS), ‘Simple Mail Transfer Protocol (SMTP), Domain Name System (DNS), Internet Protocol Security (IPsec), Voice over Internet Protocol (VoIP), remote procedure call (RPC), Linux/Unix, Telnet, File Transfer Protocol (FTP), Trivial FTP (TFTP), Server Message Block (SMB), Internet Protocol version 6 (|Pv6), and Border Gateway Protocol (BGP) enumeration. The module ends with an overview of ‘enumeration countermeasures. At the end of this module, you will be able to: Describe enumeration concepts "Explain different techniques for NetBIOS enumeration "Explain different techniques for SNMP enumeration "Explain different techniques for LDAP enumeration Explain different techniques for NTP enumeration Explain different techniques for NFS enumeration Explain different techniques for SMTP and DNS enumeration Explain other enumeration techniques such as IPsec, VoIP, RPC, Linux/Unix, Telnet, FTP, TFTP, SMB, IPv6, and BGP enumeration = Apply enumeration countermeasures Module 04 Page 292 Ethical Making and Countermeasures Copyright © by E-Cauncil ‘Al Rights Reserved. Reproduction Sel ProhiatedEthical Hacking and Countermeasures Enumeration ‘eam 31250 Cerfied thea ker Module Flow Enumeration Concepts NetBIOS Enumeration SNMP Enumeration LDAP Enumeration | | © reper smamension | | | © srr ss ns esameratin | | Je oases | | Jo ricinus coiniasens | Enumeration Concepts Inthe enumeration phase, attackers enumerate usernames and other information on the groups, network shares, and services of networked computers. This information helps attackers identify vulnerabilities in the target network and exploit them to hack the system. Different sections of this module deal with the enumeration of different services and ports. Before discussing the actual enumeration process, we introduce concepts related to ‘enumeration. ‘Module 04 Page 252 Ethical Making and Countermeasures Copyright © by E-Cauncil ‘Al Rights Reserved. Reproduction Sel ProhiatedEthical Hacking and Countermeasures ‘eam 31250 Cerfied thea ker Enumeration 3 3 | What is Enumeration? CEH Taformation Ennmaarasoa hy Zatraders (©. Enuperaton moines atacter esting sive ‘connections with atargt system and performing $B) ketwork resources (Grocid quia te pin more ntoraion atthe target ch Network shares ee Routing abies |G Arrackers use the extracted information to identify Dots fora eystem attack and perform password Aut and service etings tacks to gain unadthorzee access to nformation system resources HB sump ana aon dette 5] _ machine names |. Enumeration techniques are conducted in an intranet B. Vers and groups ‘environment ()_Apptetions ane banners What is Enumeration? Enumeration is the process of extracting usernames, machine names, network resources, shares, and services from a system or network. In the enumeration phase, an attacker creates active connections with the system and sends directed queries to gain more information about the target. The attacker uses the information collected using enumeration to identify vulnerabilities in the system security, which help them exploit the target system. In turn, enumeration allows the attacker to perform password attacks to gain unauthorized access to information system resources. Enumeration techniques work in an intranet environment. In particular, enumeration allows the attacker to collect the following information: Network resources = SNIMP and fully quali (FQDN) details "Machine names ied domain name = Network shares "Routing tables Audit and service settings * Users and groups "Applications and banners During enumeration, attackers may stumble upon a remote inter-process communication (IPC) share, such as IPC$ in Windows, which they can probe further to connect to an administrative share by brute-forcing admin credentials and obtain complete information about the file-system listing that the share represents. The previous modules highlighted how attackers gather necessary information about a target without any illegal activity. However, enumeration activities may be illegal depending on the ‘organization's policies and the laws that are in effect. An ethical hacker or pen tester should always acquire proper authorization before performing enumeration. ‘Module 04 Page 293 Ethical Making and Countermeasures Copyight © by E-Caunedl ‘Al Rights Reserved. Reproduction Sel ProhiatedEthical Hacking and Countermeasures ‘eam 31250 Cerfied thea ker toumesnon ; | Techniques for Enumeration CEH Extract usernames using pe Extract information using OF email IDs. default passwords: zs cst see 2 Selsmmmiio Fejaemonle ienaous SB same Techniques for Enumeration The following techniques are used to extract information about a target. Extract usernames using email IDs Every email address contains two parts, a username and a domain name, in the format “username@domainname.” Extract information using default passwords Many online resources provide a list of default passwords assigned by manufacturers to their products. Users often ignore recommendations to change the default usernames and passwords provided by the manufacturer or developer of a product. This eases an attacker's task of enumerating and exploiting the target system. Brute force Active Directory Microsoft Active Directory is susceptible to username enumeration at the time of user- supplied input verification. This is a design error in the Microsoft Active Directory implementation. If a user enables the "logon hours” feature, then all the attempts at service authentication result in different error messages. Attackers take advantage of this, to enumerate valid usernames. An attacker who succeeds in extracting valid usernames can conduct a brute-force attack to crack the respective passwords. Extract information using DNS Zone Transfer ‘A network administrator can use DNS zone transfer to replicate DNS data across several DNS servers or back up DNS files. For this purpose, the administrator needs to execute a specific zone-transfer request to the name server. If the name server permits zone Module 04 Page 284 Ethical Making and Countermeasures Copyright © by E-Cauncil ‘Al Rights Reserved. Reproduction Sel ProhiatedEthical Hacking and Countermeasures ‘eam 31250 Cerfied thea ker Enumeration transfer, it will convert all the DNS names and IP addresses hosted by that server to ASCII text. If the network administrators did not configure the DNS server properly, the ONS zone transfer can be an effective method to obtain information about the organization's network. This information may include lists of all named hosts, sub-zones, and related IP addresses. A user can perform DNS zone transfer using nslookup and dig commands. Extract user groups from Windows To extract user groups from Windows, the attacker should have a registered ID as a user in the Active Directory. The attacker can then extract information from groups in which the user is a member by using the Windows interface or command-line method. "Extract usernames using SNMP Attackers can easily guess read-only or read-write community strings by using the SNMP. application programming interface (API) to extract usernames. ‘Module 04 Page 295 Ethical Making and Countermeasures Copyright © by E-Cauncil ‘Al Rights Reserved. Reproduction Sel Prohiated
You might also like
5.Sc 900 Master Cheat Sheet
PDF
No ratings yet
5.Sc 900 Master Cheat Sheet
48 pages
Module 6 System Hacking
PDF
100% (1)
Module 6 System Hacking
291 pages
Threat Modeling in Security Architecture - The Nature of Threats
PDF
No ratings yet
Threat Modeling in Security Architecture - The Nature of Threats
4 pages
Module 12 Evading IDS Firewall and Honeybots
PDF
No ratings yet
Module 12 Evading IDS Firewall and Honeybots
136 pages
Module 11 Session Hijacking
PDF
No ratings yet
Module 11 Session Hijacking
86 pages
Module 16 Hacking Wireless Networks
PDF
No ratings yet
Module 16 Hacking Wireless Networks
209 pages
Module 20 Cryptography
PDF
No ratings yet
Module 20 Cryptography
124 pages
Module 10 Denial of Service
PDF
No ratings yet
Module 10 Denial of Service
91 pages
Module 9 Social Engineering
PDF
No ratings yet
Module 9 Social Engineering
83 pages
Module 8 Sniffing
PDF
No ratings yet
Module 8 Sniffing
121 pages
Module 1 Introduction To Ethical Hacking
PDF
No ratings yet
Module 1 Introduction To Ethical Hacking
91 pages
Module 3 Scanning Networks
PDF
No ratings yet
Module 3 Scanning Networks
154 pages
Mitre Attack
PDF
No ratings yet
Mitre Attack
3 pages
Hands-On Ethical Hacking and Network Defense
PDF
No ratings yet
Hands-On Ethical Hacking and Network Defense
41 pages
CEH Lesson 4 - Snipping, Session Hijacking, and DoS
PDF
No ratings yet
CEH Lesson 4 - Snipping, Session Hijacking, and DoS
25 pages
CEH
PDF
No ratings yet
CEH
14 pages
NTLM Kerberos and Public Key Cryptography (1) 55-1
PDF
No ratings yet
NTLM Kerberos and Public Key Cryptography (1) 55-1
27 pages
Chapter 1-4
PDF
No ratings yet
Chapter 1-4
135 pages
Ceh Practice Questions
PDF
No ratings yet
Ceh Practice Questions
11 pages
Lab 1 - Footprinting Using NIKTO and Theharvester
PDF
No ratings yet
Lab 1 - Footprinting Using NIKTO and Theharvester
2 pages
EC-Council - CEHv8 Module 17 Evading IDS, Firewalls, and Honeypots Slide 2013
PDF
No ratings yet
EC-Council - CEHv8 Module 17 Evading IDS, Firewalls, and Honeypots Slide 2013
142 pages
Module 13 Hacking Web Server
PDF
100% (1)
Module 13 Hacking Web Server
117 pages
Lec 06 - Components of PKI
PDF
No ratings yet
Lec 06 - Components of PKI
50 pages
10.6.7 Lab - Using Wireshark To Examine HTTP and HTTPS Traffic
PDF
No ratings yet
10.6.7 Lab - Using Wireshark To Examine HTTP and HTTPS Traffic
7 pages
Public Key Infrastructure
PDF
No ratings yet
Public Key Infrastructure
10 pages
Ccs Module 2
PDF
No ratings yet
Ccs Module 2
85 pages
Module 1
PDF
No ratings yet
Module 1
90 pages
My CEHpractica Lcheat Sheet
PDF
No ratings yet
My CEHpractica Lcheat Sheet
6 pages
By Gopalsamy Rajendran
PDF
No ratings yet
By Gopalsamy Rajendran
19 pages
my notes
PDF
No ratings yet
my notes
4 pages
Lab Experiment #08 - Network & Host Detection Scans
PDF
No ratings yet
Lab Experiment #08 - Network & Host Detection Scans
3 pages
Hunting For Vulnerabilities Using Metasploit
PDF
No ratings yet
Hunting For Vulnerabilities Using Metasploit
12 pages
CEH v12 - Module13@nettrain
PDF
No ratings yet
CEH v12 - Module13@nettrain
110 pages
Nessus Lab V12nov07
PDF
No ratings yet
Nessus Lab V12nov07
6 pages
Digital Signature
PDF
No ratings yet
Digital Signature
31 pages
350_Hunting_With_PowerShell
PDF
No ratings yet
350_Hunting_With_PowerShell
74 pages
Cyber-Security Training
PDF
No ratings yet
Cyber-Security Training
22 pages
CEH v11 - Module 14
PDF
No ratings yet
CEH v11 - Module 14
287 pages
Module 02 - Footprinting and Reconnaissance - Lab 5 - Perform Email Footprinting
PDF
No ratings yet
Module 02 - Footprinting and Reconnaissance - Lab 5 - Perform Email Footprinting
12 pages
OSI Model CheatSheet - ATech (Waqas Karim) v1.2
PDF
No ratings yet
OSI Model CheatSheet - ATech (Waqas Karim) v1.2
1 page
Dhruvi CEHV12
PDF
No ratings yet
Dhruvi CEHV12
58 pages
CEH v12 - Module11@nettrain
PDF
No ratings yet
CEH v12 - Module11@nettrain
96 pages
Pentesting Wifi - HackTricks - HackTricks
PDF
No ratings yet
Pentesting Wifi - HackTricks - HackTricks
31 pages
Planning and Designing A Windows Server Environment
PDF
No ratings yet
Planning and Designing A Windows Server Environment
34 pages
3.scanning Network
PDF
No ratings yet
3.scanning Network
25 pages
CEH Lesson 6 - Social Engineering
PDF
No ratings yet
CEH Lesson 6 - Social Engineering
17 pages
Exfiltration Method For Channels
PDF
No ratings yet
Exfiltration Method For Channels
27 pages
Nessus 10 6
PDF
No ratings yet
Nessus 10 6
857 pages
2-Hunting Insider Threats Part 1
PDF
No ratings yet
2-Hunting Insider Threats Part 1
22 pages
Eccouncil Pre - 312-50v12 50q-DEMO
PDF
No ratings yet
Eccouncil Pre - 312-50v12 50q-DEMO
25 pages
310 Red Teaming MS SQL Server PDF
PDF
No ratings yet
310 Red Teaming MS SQL Server PDF
139 pages
PPT ch18
PDF
No ratings yet
PPT ch18
65 pages
Module 7 Security Misconfiguration Lab
PDF
No ratings yet
Module 7 Security Misconfiguration Lab
4 pages
IP Access Lists Com
PDF
100% (1)
IP Access Lists Com
1 page
How To Implement SSL Decryption PDF
PDF
No ratings yet
How To Implement SSL Decryption PDF
11 pages
CPENT Module 09 Wireless Penetration Testing
PDF
No ratings yet
CPENT Module 09 Wireless Penetration Testing
49 pages
Ethical Hacking Chap - 1
PDF
No ratings yet
Ethical Hacking Chap - 1
17 pages
Pentesting Report
PDF
No ratings yet
Pentesting Report
31 pages
Assignment# 02 Wireshark - HTTP
PDF
No ratings yet
Assignment# 02 Wireshark - HTTP
5 pages
Eh Unit 3
PDF
No ratings yet
Eh Unit 3
77 pages