Open navigation menu
Close suggestions
Search
Search
en
Change Language
Upload
Sign in
Sign in
Download free for days
0 ratings
0% found this document useful (0 votes)
144 views
Module 4 Enumeration
Uploaded by
Nghia Tran Van
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content,
claim it here
.
Available Formats
Download as PDF or read online on Scribd
Download now
Download
Save Module 4 Enumeration For Later
Download
Save
Save Module 4 Enumeration For Later
0%
0% found this document useful, undefined
0%
, undefined
Embed
Share
Print
Report
0 ratings
0% found this document useful (0 votes)
144 views
Module 4 Enumeration
Uploaded by
Nghia Tran Van
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content,
claim it here
.
Available Formats
Download as PDF or read online on Scribd
Download now
Download
Save Module 4 Enumeration For Later
Carousel Previous
Carousel Next
Save
Save Module 4 Enumeration For Later
0%
0% found this document useful, undefined
0%
, undefined
Embed
Share
Print
Report
Download now
Download
You are on page 1
/ 92
Search
Fullscreen
Module 04: EnumerationEthical Hacking and Countermeasures ‘eam 31250 Cerfied thea ker Enumeration Module Objectives ¢ |EH o Understanding Enumeration Concepts . Understanding bier Tues fr He Eurersion Understanding offerent Techniques fr SAM and LDAP Enumeration ‘ 2p Une ee es Pan WS reten Understanding Other Enumeration such 5 Pec, VI, RPC, Lnuy/Uns,Tlet, FT, TER, SMB Understanding Otter Enumeration Countermeasures Module Objectives In the previous modules, you learned about footprinting and network scanning. This module covers the next phase, enumeration. We start with an introduction to enumeration concepts. Subsequently, the module provides insight into different techniques for Network Basic Input/Output System (NetBIOS), Simple Network Management Protocol (SNMP), Lightweight Directory Access Protocol (LDAP), Network Time Protocol (NTP), Network File System (NFS), ‘Simple Mail Transfer Protocol (SMTP), Domain Name System (DNS), Internet Protocol Security (IPsec), Voice over Internet Protocol (VoIP), remote procedure call (RPC), Linux/Unix, Telnet, File Transfer Protocol (FTP), Trivial FTP (TFTP), Server Message Block (SMB), Internet Protocol version 6 (|Pv6), and Border Gateway Protocol (BGP) enumeration. The module ends with an overview of ‘enumeration countermeasures. At the end of this module, you will be able to: Describe enumeration concepts "Explain different techniques for NetBIOS enumeration "Explain different techniques for SNMP enumeration "Explain different techniques for LDAP enumeration Explain different techniques for NTP enumeration Explain different techniques for NFS enumeration Explain different techniques for SMTP and DNS enumeration Explain other enumeration techniques such as IPsec, VoIP, RPC, Linux/Unix, Telnet, FTP, TFTP, SMB, IPv6, and BGP enumeration = Apply enumeration countermeasures Module 04 Page 292 Ethical Making and Countermeasures Copyright © by E-Cauncil ‘Al Rights Reserved. Reproduction Sel ProhiatedEthical Hacking and Countermeasures Enumeration ‘eam 31250 Cerfied thea ker Module Flow Enumeration Concepts NetBIOS Enumeration SNMP Enumeration LDAP Enumeration | | © reper smamension | | | © srr ss ns esameratin | | Je oases | | Jo ricinus coiniasens | Enumeration Concepts Inthe enumeration phase, attackers enumerate usernames and other information on the groups, network shares, and services of networked computers. This information helps attackers identify vulnerabilities in the target network and exploit them to hack the system. Different sections of this module deal with the enumeration of different services and ports. Before discussing the actual enumeration process, we introduce concepts related to ‘enumeration. ‘Module 04 Page 252 Ethical Making and Countermeasures Copyright © by E-Cauncil ‘Al Rights Reserved. Reproduction Sel ProhiatedEthical Hacking and Countermeasures ‘eam 31250 Cerfied thea ker Enumeration 3 3 | What is Enumeration? CEH Taformation Ennmaarasoa hy Zatraders (©. Enuperaton moines atacter esting sive ‘connections with atargt system and performing $B) ketwork resources (Grocid quia te pin more ntoraion atthe target ch Network shares ee Routing abies |G Arrackers use the extracted information to identify Dots fora eystem attack and perform password Aut and service etings tacks to gain unadthorzee access to nformation system resources HB sump ana aon dette 5] _ machine names |. Enumeration techniques are conducted in an intranet B. Vers and groups ‘environment ()_Apptetions ane banners What is Enumeration? Enumeration is the process of extracting usernames, machine names, network resources, shares, and services from a system or network. In the enumeration phase, an attacker creates active connections with the system and sends directed queries to gain more information about the target. The attacker uses the information collected using enumeration to identify vulnerabilities in the system security, which help them exploit the target system. In turn, enumeration allows the attacker to perform password attacks to gain unauthorized access to information system resources. Enumeration techniques work in an intranet environment. In particular, enumeration allows the attacker to collect the following information: Network resources = SNIMP and fully quali (FQDN) details "Machine names ied domain name = Network shares "Routing tables Audit and service settings * Users and groups "Applications and banners During enumeration, attackers may stumble upon a remote inter-process communication (IPC) share, such as IPC$ in Windows, which they can probe further to connect to an administrative share by brute-forcing admin credentials and obtain complete information about the file-system listing that the share represents. The previous modules highlighted how attackers gather necessary information about a target without any illegal activity. However, enumeration activities may be illegal depending on the ‘organization's policies and the laws that are in effect. An ethical hacker or pen tester should always acquire proper authorization before performing enumeration. ‘Module 04 Page 293 Ethical Making and Countermeasures Copyight © by E-Caunedl ‘Al Rights Reserved. Reproduction Sel ProhiatedEthical Hacking and Countermeasures ‘eam 31250 Cerfied thea ker toumesnon ; | Techniques for Enumeration CEH Extract usernames using pe Extract information using OF email IDs. default passwords: zs cst see 2 Selsmmmiio Fejaemonle ienaous SB same Techniques for Enumeration The following techniques are used to extract information about a target. Extract usernames using email IDs Every email address contains two parts, a username and a domain name, in the format “username@domainname.” Extract information using default passwords Many online resources provide a list of default passwords assigned by manufacturers to their products. Users often ignore recommendations to change the default usernames and passwords provided by the manufacturer or developer of a product. This eases an attacker's task of enumerating and exploiting the target system. Brute force Active Directory Microsoft Active Directory is susceptible to username enumeration at the time of user- supplied input verification. This is a design error in the Microsoft Active Directory implementation. If a user enables the "logon hours” feature, then all the attempts at service authentication result in different error messages. Attackers take advantage of this, to enumerate valid usernames. An attacker who succeeds in extracting valid usernames can conduct a brute-force attack to crack the respective passwords. Extract information using DNS Zone Transfer ‘A network administrator can use DNS zone transfer to replicate DNS data across several DNS servers or back up DNS files. For this purpose, the administrator needs to execute a specific zone-transfer request to the name server. If the name server permits zone Module 04 Page 284 Ethical Making and Countermeasures Copyright © by E-Cauncil ‘Al Rights Reserved. Reproduction Sel ProhiatedEthical Hacking and Countermeasures ‘eam 31250 Cerfied thea ker Enumeration transfer, it will convert all the DNS names and IP addresses hosted by that server to ASCII text. If the network administrators did not configure the DNS server properly, the ONS zone transfer can be an effective method to obtain information about the organization's network. This information may include lists of all named hosts, sub-zones, and related IP addresses. A user can perform DNS zone transfer using nslookup and dig commands. Extract user groups from Windows To extract user groups from Windows, the attacker should have a registered ID as a user in the Active Directory. The attacker can then extract information from groups in which the user is a member by using the Windows interface or command-line method. "Extract usernames using SNMP Attackers can easily guess read-only or read-write community strings by using the SNMP. application programming interface (API) to extract usernames. ‘Module 04 Page 295 Ethical Making and Countermeasures Copyright © by E-Cauncil ‘Al Rights Reserved. Reproduction Sel Prohiated
You might also like
Module 6 System Hacking
PDF
100% (1)
Module 6 System Hacking
291 pages
Ec-Council Actualtests 312-50v12 Exam Question 2023-Jul-30 by Cedric 306q Vce
PDF
No ratings yet
Ec-Council Actualtests 312-50v12 Exam Question 2023-Jul-30 by Cedric 306q Vce
33 pages
CEH v10 Module 04 - Enumeration
PDF
No ratings yet
CEH v10 Module 04 - Enumeration
35 pages
Module 11 Session Hijacking
PDF
No ratings yet
Module 11 Session Hijacking
86 pages
Module 8 Sniffing
PDF
No ratings yet
Module 8 Sniffing
121 pages
Module 16 Hacking Wireless Networks
PDF
No ratings yet
Module 16 Hacking Wireless Networks
209 pages
Module 12 Evading IDS Firewall and Honeybots
PDF
No ratings yet
Module 12 Evading IDS Firewall and Honeybots
136 pages
Module 9 Social Engineering
PDF
No ratings yet
Module 9 Social Engineering
83 pages
Module 20 Cryptography
PDF
No ratings yet
Module 20 Cryptography
124 pages
Hands-On Ethical Hacking and Network Defense
PDF
No ratings yet
Hands-On Ethical Hacking and Network Defense
41 pages
Module 10 Denial of Service
PDF
No ratings yet
Module 10 Denial of Service
91 pages
Module 13 Hacking Web Server
PDF
100% (1)
Module 13 Hacking Web Server
117 pages
CEH v12 - Module11@nettrain
PDF
No ratings yet
CEH v12 - Module11@nettrain
96 pages
Module 1 Introduction To Ethical Hacking
PDF
No ratings yet
Module 1 Introduction To Ethical Hacking
91 pages
Certified Ethical Hacker Certified Ethical Hacker: 10 (Practical)
PDF
No ratings yet
Certified Ethical Hacker Certified Ethical Hacker: 10 (Practical)
12 pages
Lab Experiment #08 - Network & Host Detection Scans
PDF
No ratings yet
Lab Experiment #08 - Network & Host Detection Scans
3 pages
CEH v11 - Module 14
PDF
No ratings yet
CEH v11 - Module 14
287 pages
CEH Master Brochure
PDF
No ratings yet
CEH Master Brochure
14 pages
My CEHpractica Lcheat Sheet
PDF
No ratings yet
My CEHpractica Lcheat Sheet
6 pages
Mayur Kumar Jain - (Resume)
PDF
No ratings yet
Mayur Kumar Jain - (Resume)
3 pages
ECSA v03 Network - Perimeter Testing (2011) CT
PDF
0% (1)
ECSA v03 Network - Perimeter Testing (2011) CT
135 pages
EC-Council - CEHv8 Module 17 Evading IDS, Firewalls, and Honeypots Slide 2013
PDF
No ratings yet
EC-Council - CEHv8 Module 17 Evading IDS, Firewalls, and Honeypots Slide 2013
142 pages
my notes
PDF
No ratings yet
my notes
4 pages
Mitre Attack
PDF
No ratings yet
Mitre Attack
3 pages
OffSec Federal Presentation
PDF
100% (1)
OffSec Federal Presentation
17 pages
Understanding AD Enumeration
PDF
No ratings yet
Understanding AD Enumeration
101 pages
Nmap6 Cheatsheet Eng v1 PDF
PDF
100% (1)
Nmap6 Cheatsheet Eng v1 PDF
1 page
CEH Notes
PDF
No ratings yet
CEH Notes
12 pages
Penetration Testing
PDF
No ratings yet
Penetration Testing
12 pages
CEH Lesson 4 - Snipping, Session Hijacking, and DoS
PDF
No ratings yet
CEH Lesson 4 - Snipping, Session Hijacking, and DoS
25 pages
By Gopalsamy Rajendran
PDF
No ratings yet
By Gopalsamy Rajendran
19 pages
Cyber Security Question
PDF
No ratings yet
Cyber Security Question
10 pages
Ec Council.2passeasy.312 50v12.PDF.2022 Oct 21.by - Christopher.169q.vce
PDF
No ratings yet
Ec Council.2passeasy.312 50v12.PDF.2022 Oct 21.by - Christopher.169q.vce
16 pages
CEH v12 Lesson 9 - Social Engineering Exploits
PDF
No ratings yet
CEH v12 Lesson 9 - Social Engineering Exploits
7 pages
CEH v9 Notes
PDF
No ratings yet
CEH v9 Notes
39 pages
Lab 1 - Footprinting Using NIKTO and Theharvester
PDF
No ratings yet
Lab 1 - Footprinting Using NIKTO and Theharvester
2 pages
CEH v12 Lesson 7 _ Web Application Exploitatio (1)
PDF
No ratings yet
CEH v12 Lesson 7 _ Web Application Exploitatio (1)
40 pages
Wireshark Slides PDF
PDF
No ratings yet
Wireshark Slides PDF
11 pages
MS-900
PDF
No ratings yet
MS-900
63 pages
Certified Ethical Hacker Ceh Crash Course
PDF
No ratings yet
Certified Ethical Hacker Ceh Crash Course
2 pages
CEH v12 - Module13@nettrain
PDF
No ratings yet
CEH v12 - Module13@nettrain
110 pages
CEH Brochure
PDF
No ratings yet
CEH Brochure
24 pages
Module 02 - Penetration Testing Scoping and Engagement Methodology
PDF
No ratings yet
Module 02 - Penetration Testing Scoping and Engagement Methodology
50 pages
Ethical Hacking: Click To Edit Master Subtitle Style
PDF
No ratings yet
Ethical Hacking: Click To Edit Master Subtitle Style
26 pages
SMB Enumeration
PDF
No ratings yet
SMB Enumeration
23 pages
CEH v12 Lesson 9 - Exploiting Wireless Vulnera
PDF
100% (1)
CEH v12 Lesson 9 - Exploiting Wireless Vulnera
18 pages
CEH Lesson 6 - Social Engineering
PDF
No ratings yet
CEH Lesson 6 - Social Engineering
17 pages
Session Hijacking
PDF
No ratings yet
Session Hijacking
50 pages
Netwrix Hardened Services Guide
PDF
No ratings yet
Netwrix Hardened Services Guide
116 pages
Advanced Cross Site Scripting: and CSRF
PDF
No ratings yet
Advanced Cross Site Scripting: and CSRF
42 pages
Web Penetration Testing Roadmap (1)
PDF
No ratings yet
Web Penetration Testing Roadmap (1)
11 pages
CF Lecture 06-File System and OS
PDF
No ratings yet
CF Lecture 06-File System and OS
43 pages
Ec-Council - Iclass: Incident Handling and Response Track
PDF
No ratings yet
Ec-Council - Iclass: Incident Handling and Response Track
1 page
Module 9: Configuring IPsec
PDF
No ratings yet
Module 9: Configuring IPsec
25 pages
Pentesting Wifi - HackTricks - HackTricks
PDF
No ratings yet
Pentesting Wifi - HackTricks - HackTricks
31 pages
Metasploit Pro v4.11
PDF
No ratings yet
Metasploit Pro v4.11
188 pages
Digital Signature
PDF
No ratings yet
Digital Signature
31 pages
Eh Unit 3
PDF
No ratings yet
Eh Unit 3
77 pages
Ethical Hacking
PDF
No ratings yet
Ethical Hacking
43 pages
Enumeration EH A
PDF
No ratings yet
Enumeration EH A
35 pages