Enumeration Tools Flashcards
Process to identify and scan network ranges and hosts belonging to the target and
map out an attack surface
Enumeration
A connection is made from the attacker to a target and data is
transmitted
Active
No connection is made from the attacker to a target and data
collected can be analyzed
Network sniffers are considered a passive form of enumeration
Wireshark
Zeek or Bro
p0f
Passive
Tools that map out the layout of a network, typically in terms of IP address usage,
routing topology, and DNS namespace (subdomains and hostnames)
Footprinting
Tools that perform host system detection to map out open ports, OS type and
version, file shares, running services and applications, system uptime, and other
useful metadata
Fingerprinting
A versatile port scanner used for topology, host, service, and OS discovery and
enumeration
A nmap discovery scan is used to footprint the network
Nmap Security Scanner
Lists the IP addresses from the supplied target range(s) and performs a
reverse-DNS query to discover any host names associated with those
IPs
List Scan (-sL)
Probes specific ports from the given list using a TCP SYN packet instead
of an ICMP packet to conduct the ping
TCP SYN ping (-PS <PortList>)</PortList>
Issues probes with significant delays to become stealthier and avoid
detection by an IDS or IPS
Sparse Scanning (–scan-delay <Time>)</Time>
Issues probes with using a timing pattern with n being the pattern to
utilize (0 is slowest and 5 is fastest)
Scan Timing (-Tn)
A technique that splits the TCP header of each probe between multiple
IP datagrams to make it hard for an IDS or IPS to detect
Fragmentation (-f or –mtu)
After your footprinting is complete, it is time to begin fingerprinting hosts
Nmap Port Scans
Conducts a half-open scan by sending a SYN packet to identify the port
state without sending an ACK packet afterwards
TCP SYN (-sS)
Conducts a three-way handshake scan by sending a SYN packet to
identify the port state and then sending an ACK packet once the SYNACK is received
TCP Connect (-sT)
Conducts a scan by sending a packet with the header bit set to zero
Null Scan (-sN)
Conducts a scan by sending an unexpected FIN packet
FIN Scan (-sF)
Conducts a scan by sending an unexpected FIN packet
FIN Scan (-sF)
Conducts a scan by sending a packet with the FIN, PSH, and URG flags
set to one
Xmas Scan (-sX)
Conducts a scan by sending a UDP packet to the target and waiting for a
response or timeout
UDP Scan (-sU)
Conducts a scan by targeting the specified ports instead of the default
of the 1,000 most commonly used ports
Port Range (-p)
An application on the host is accepting connections
Open
The port responds to probes by sending a reset [RST] packet, but no application is
available to accept connections
Closed
Nmap cannot probe the port, usually due to a firewall blocking the scans on the
network or host
Filtered
Nmap can probe the port but cannot determine if it is open or closed
Unfiltered
Nmap cannot determine if the port is open or filtered when conducting
a UDP or IP protocol scan
Open|Filtered
Nmap cannot determine if the port is closed or filtered when
conducting a TCP Idle scan
Closed|Filtered
Scheme for identifying hardware devices, operating systems, and
applications developed by MITRE
Common Platform Enumeration
Scripts are written in the Lua scripting language that can be used to
carry out detailed probes
Nmap Scripting Engine (NSE)
An open-source spoofing tool that provides a pen tester with the ability to craft
network packets to exploit vulnerable firewalls and IDS/IPS
hping
Send a SYN or ACK packet to conduct detection and testing
Host/port Detection and Firewall Testing
Used to determine the system’s uptime
Timestamping
Use arbitrary packet formats, such as probing DNS ports using TCP or UDP, to
perform traces when ICMP is blocked on a given network
Traceroute
Attempts to evade detection by IDS/IPS and firewalls by sending fragmented
packets across the network for later reassembly
Fragmentation
A command-line tool used to poison responses to NetBIOS, LLMNR, and MDNS
name resolution requests in an attempt to perform a man-in-the-middle attack
Responder
Tools used to detect the presence of wireless networks, identify the security type
and configuration, and try to exploit any weaknesses in the security to gain
unauthorized access to the network
Wireless Assessment Tools
A suite of utilities designed for wireless network security testing
Aircrack-ng Suite
A command-line tool used to perform brute force attacks against WPS-enabled
access points
Reaver
A command-line tool used to perform brute force and dictionary attacks against password
hashes
Hashcat
