Enumerating Network Services

Hello! Welcome back to your course on penetration testing and bug bounty hunting.

In our last lesson, you learned to perform service and version enumeration with Nmap. By using flags like -sV and -A, you can now identify the specific software and version running on an open port, turning a simple port scan into a treasure map of potential targets.

Today, we'll follow that map. This lesson directly addresses the learning outcome: Enumerate common network services like SMB, FTP, and DNS to gather detailed configuration and user information. We will move beyond just identifying a service and learn to interact with it using specialized tools to extract valuable intelligence like file listings, user accounts, and network architecture details. This is the crucial step where you gather the specific information needed to formulate an attack.

Let's begin by looking at some of the most common services you'll encounter.

1. FTP Enumeration: The Anonymous Check

File Transfer Protocol (FTP), typically on port 21, is one of the oldest services you'll find. While its use has declined, it's still present in many environments. The number one goal when enumerating FTP is to check for anonymous login. This misconfiguration allows any user to log in without a password, potentially exposing sensitive files.

You can test this manually with the built-in ftp client on Kali Linux. When prompted for a name, use anonymous or ftp. For the password, simply press Enter.

# ftp <target_ip>
Connected to <target_ip>.
220 (vsFTPd 2.3.4)
Name (10.10.10.3:user): anonymous
331 Please specify the password.
Password:
230 Login successful.
ftp> ls

If login is successful, you have an interactive shell. You can use commands like ls to list files, cd to change directories, and get to download files. You should look for configuration files, scripts, user lists, or any data that seems out of place or sensitive.

Automating with Nmap Scripts

Manually checking is good for understanding the process, but you can automate it with the Nmap Scripting Engine (NSE). The ftp-anon script does exactly what we just did manually.

nmap -p 21 --script ftp-anon <target_ip>

If anonymous login is permitted, the output will clearly state it:

PORT   STATE SERVICE
21/tcp open  ftp
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_Can't get directory listing: TIMEOUT

An allowed anonymous login is a significant finding and often your first foothold.

2. SMB Enumeration: Peeking into Windows Networks

Server Message Block (SMB) is a protocol used primarily in Windows networks for file sharing, printer sharing, and inter-process communication. It typically runs on port 445. Properly configured, it's secure. Misconfigured, it's a goldmine of information.

Our goals with SMB enumeration are to:

1. List available file shares.
2. Determine our permissions on those shares (e.g., can we read or write files?).
3. Enumerate users and groups on the system.

The following video provides a great practical introduction to the core tools used for this.

Key Tools for SMB Enumeration

Based on the video, here are the essential commands to start with:

• List Shares: Use smbclient to see what shares are broadcast by the server. The -N flag attempts a "null session" (anonymous-like access).

  smbclient -L //<target_ip> -N
  

• Check Permissions: smbmap is excellent for quickly seeing your access level to each share. READ access is good; WRITE access is even better.

  smbmap -H <target_ip>
  

• Connect to a Share: Once you find a share you can access (e.g., Public with READ access), you can connect to it with smbclient and browse it like a filesystem.

  smbclient //<target_ip>/Public -N
  

  Inside the client, use ls, cd, get <filename>, and put <filename>.

Advanced User Enumeration: RID Cycling

Beyond file shares, SMB can be used to discover valid usernames and groups on a Windows host through a technique called RID Cycling. This technique exploits the fact that every user and group has a unique Security Identifier (SID), and the last part of the SID, the Relative ID (RID), is often sequential. By guessing RIDs (e.g., 1000, 1001, 1002), we can resolve them back to usernames.

This is a more advanced technique that demonstrates how deep enumeration can go. The following cheatsheet provides an excellent overview.

Tools like netexec (the successor to crackmapexec) and Impacket's lookupsid.py can automate RID cycling to quickly dump a list of all users on a system, which is invaluable for later attacks like password spraying.

3. DNS Enumeration: Mapping the Kingdom

The Domain Name System (DNS), on port 53, translates domain names to IP addresses. While your theoretical networking knowledge covers its legitimate use, for a pentester, DNS is a map to an organization's digital infrastructure. Effective DNS enumeration can reveal subdomains, internal servers, mail servers, and other network information that isn't publicly advertised.

The most sought-after prize in DNS enumeration is a successful Zone Transfer (AXFR). This is a mechanism for replicating DNS records between servers. If a DNS server is misconfigured to allow zone transfers to anyone, it will hand over its entire database of records for a domain.

This video from HackerSploit provides a clear walkthrough of the concepts and tools.

Core DNS Enumeration Techniques

As you saw in the video, the workflow typically involves:

1. Finding Name Servers (NS): Identify the authoritative DNS servers for a domain.
   host -t ns <domain.com>
2. Attempting a Zone Transfer: Use dig to request an AXFR from each name server.
   dig axfr @<nameserver_ip> <domain.com>
3. Automated Enumeration: If a zone transfer fails, use tools like dnsenum or dnsrecon to brute-force subdomains using wordlists and query for various record types (A, MX, TXT, SRV).

Here is an example of the rich output from a successful DNS enumeration using dnsrecon.

For a quick reference of commands for various DNS enumeration techniques, the guide below is an excellent resource to bookmark.

Conclusion

In this lesson, you've learned to move past simple port scanning and engage directly with common network services to extract actionable intelligence. This is a fundamental skill that separates a beginner from a practitioner.

Key Takeaways:

• Enumeration goes beyond just finding a service; it's about interrogating it for configuration details, user information, and files.
• FTP: The primary goal is to check for anonymous login using ftp or nmap --script ftp-anon. A successful login is often an easy win.
• SMB: A rich source of information on Windows networks. Use smbclient and smbmap to find and access file shares, and learn about advanced techniques like RID cycling to enumerate users.
• DNS: Key to mapping an organization's attack surface. A successful Zone Transfer (AXFR) is a critical finding that can expose the entire domain infrastructure. dig, dnsenum, and dnsrecon are your go-to tools.

Next Lesson Preview:
So far, we have focused on active reconnaissance, where we directly interact with the target's systems. In the next lesson, we will switch gears to passive reconnaissance. You will learn how to extract metadata from public documents and analyze social media to gather intelligence on a target—all without sending a single packet to their servers.