- Our goal for Enumeration is to extract information
about the systems that we are trying to compromise,
and this can give us avenues of attack.
For example, if we're able to extract user names,
or group names, SNMP information.
What are we going to do with this information,
or how can this information help us get into the system?
If we're able to figure out usernames
by querying an LDAP database, we know what usernames to try
when we're doing our brute-force dictionary attack
to try to log in as those users.
If we have to brute-force a username and a password,
it's gonna take a lot longer
than just brute-forcing passwords.
So, here's what we're trying to figure out.
We wanna see machine names.
Information from SNMP.
This will be network interfaces,
IP addresses, port utilization.
We wanna see some DNS names, maybe some routing tables,
some banners from services that are running.
What services are running?
We've looked at discovering available services,
when we talked
about Nmap, H-paying (as pronounced), Metasploit.
Now, what techniques are we gonna be talking about
through the remainder of this lesson?
Starting off with default passwords.
Enumerating information from a system
might require authentication to that system;
default passwords can be used for that.
We can take a look at,
what is available through active directory queries?
Extracting user groups.
Usernames from emails.
DNS Zone Transfers.
Walking with SNMP.
We're gonna take a look at all of these techniques
throughout the remainder of this lesson.
Once we have a system that we're going to target
in order to do this enumeration,
what services might we be talking to?
For example, is it a DNS server?
You gonna be listening on UDP 53, if it is?
Is it active directory?
We'll have server message block on 445.
If it's a windows, we'll have some NetBIOS stuff.
We might have LDAP on 389.
Services don't have to be running on the host.
So, you run your Nmap, see what services you can talk to?
Once you know what services you can talk to,
then you try to grab information from those services.
Also, this is important to note.
Port numbers can be changed.
It's not very common,
because if you change the port number for LDAP,
you have to change all of the systems
to talk to that port number.
So, most of the time, if you see 389, it's gonna be LDAP.