MODULE 2

19-01-2026 A. ANANDITA IYER 1

 COMPETITIVE INTELLIGENCE

Competitive intelligence gathers and analyses information regarding competitors,

market trends, and external variables influencing strategic decision-making.
In cybersecurity, competitive intelligence extends to monitoring threat landscapes,
knowledge of adversarial tactics, and compliance with industry standards.
This knowledge allows organisations to understand current risks and create
adequate defences that keep pace with a revolutionising digital ecology.

19-01-2026 A. ANANDITA IYER 2

 COMPETITIVE INTELLIGENCE

Competitive intelligence in cybersecurity originates from classical intelligence disciplines used in

military strategy and corporate decision-making. In ethical hacking, it refers to the deliberate
collection and analysis of openly available information to understand an organization’s structure,
behavior, technology stack, and operational weaknesses. At its most fundamental level,
competitive intelligence recognizes that organizations unintentionally reveal far more about
themselves than they realize.
Every digital organization leaves a trail of metadata. Corporate websites expose server
technologies through HTTP headers, analytics scripts, and embedded third-party services. Public
documentation and API references reveal backend architectures. Job postings often disclose
internal platforms such as cloud providers, security tools, authentication systems, and even internal
coding standards. These disclosures are rarely considered security risks by organizations, yet they
form the foundation of many sophisticated attacks.

19-01-2026 A. ANANDITA IYER 3

 COMPETITIVE INTELLIGENCE
As competitive intelligence matures, it moves beyond static data collection into contextual analysis.
Attackers and ethical hackers correlate business timelines with security posture. Mergers,
acquisitions, cloud migrations, outsourcing initiatives, and rapid hiring phases often introduce
systemic weaknesses. During such periods, security teams are overloaded, configurations are rushed,
and temporary access permissions persist longer than intended. Modern ransomware groups
deliberately track such events and time their attacks accordingly.
In advanced practice, competitive intelligence integrates identity exposure analysis. Ethical hackers
now examine whether employee credentials appear in historical breach datasets, password dumps,
or dark-web forums. Many real-world compromises do not involve breaking encryption or
exploiting software vulnerabilities at all. Instead, attackers authenticate legitimately using reused
passwords obtained from unrelated breaches years earlier. This shift has fundamentally changed
how cybersecurity risk is assessed, placing identity and information exposure at the center of
security strategy.

19-01-2026 A. ANANDITA IYER 4

 COMPETITIVE INTELLIGENCE

A real-world illustration of competitive intelligence misuse can be seen in targeted

phishing campaigns against technology companies and financial institutions. Attackers
craft emails referencing real internal tools, managers, and workflows using
information obtained entirely from public sources. Victims comply because the
message aligns perfectly with their daily experience. This demonstrates that
competitive intelligence transforms raw information into operational advantage,
making it one of the most powerful and underestimated components of ethical
hacking.

19-01-2026 A. ANANDITA IYER 5

 DNS ENUMERATION: UNDERSTANDING THE ARCHITECTURE
BEHIND THE DOMAIN NAME SYSTEM
The Domain Name System is one of the most critical yet misunderstood components of the
internet. It exists to translate human-friendly domain names into numerical IP addresses,
enabling global connectivity. However, because DNS must be publicly queryable to
function, it inherently exposes information about how an organization structures its
infrastructure.
At a foundational level, DNS enumeration involves identifying domain records that reveal
IP addresses, mail servers, name servers, and text-based configuration data. Even these
basic records provide insight into hosting environments, redundancy strategies, email
security mechanisms, and geographic distribution. Organizations often underestimate how
much architectural intelligence can be inferred from DNS alone.

19-01-2026 A. ANANDITA IYER 6

 DNS ENUMERATION
As enumeration deepens, subdomain discovery becomes the primary focus. Subdomains frequently
represent internal systems that were never intended for public exposure, such as development
environments, test platforms, VPN portals, API gateways, and administrative dashboards. These
systems often lack the same level of hardening as production websites. Many real-world breaches
originate from such overlooked assets rather than primary domains.
DNS enumeration has evolved significantly in cloud-centric environments. Modern organizations
rely heavily on cloud services where infrastructure is dynamic and ephemeral. A common failure
occurs when cloud resources are deleted but DNS records remain. This leads to subdomain
takeover vulnerabilities, where attackers register new cloud resources matching abandoned DNS
entries and gain control of trusted organizational subdomains. These attacks are particularly
dangerous because they allow attackers to host malicious content under legitimate domain names,
bypassing many security controls and user suspicions.

19-01-2026 A. ANANDITA IYER 7

 DNS ENUMERATION
Several high-profile organizations have experienced reputational damage due to
subdomain takeovers, demonstrating that DNS mismanagement is not a theoretical risk
but a persistent operational failure. DNS enumeration therefore serves not only as a
discovery technique but as a diagnostic tool that reveals governance and lifecycle
management weaknesses within organizations.
From a defensive perspective, DNS enumeration highlights the necessity of continuous
asset tracking and DNS hygiene. Any service reachable via DNS must be treated as
exposed, monitored, and maintained. In modern cybersecurity, DNS visibility is
inseparable from attack surface management.

19-01-2026 A. ANANDITA IYER 8

 DNS RECORDS COMMONLY ACCESSED DURING
ENUMERATION
DNS
Why It Is Important in DNS
Record Full Name What It Contains / Purpose
Enumeration
Type
Reveals the IPv4 address of servers
Maps a domain or subdomain
A Address Record hosting a service; used to identify
to an IPv4 address.
target systems for scanning.
Exposes IPv6 infrastructure, which is
IPv6 Address Maps a domain to an IPv6
AAAA often less monitored and more
Record address.
vulnerable.
Helps identify aliases, third-party
Canonical Name Maps one domain name to
CNAME services, and potential subdomain
Record another domain name.
takeover opportunities.
Specifies mail servers Reveals email infrastructure and
Mail Exchange
MX responsible for receiving helps assess phishing and email
Record
email. spoofing risks.

19-01-2026 A. ANANDITA IYER 9

 DNS RECORDS COMMONLY ACCESSED DURING
ENUMERATION
DNS Record Why It Is Important in DNS
Full Name What It Contains / Purpose
Type Enumeration
Indicates DNS hosting
Name Server Identifies authoritative DNS
NS providers and potential DNS
Record servers for the domain.
misconfigurations.
Stores arbitrary text data (SPF, Exposes email security
TXT Text Record DKIM, DMARC, verification policies, cloud verification
tokens). tokens, and misconfigurations.
Reveals zone timing, serial
Contains administrative
SOA Start of Authority numbers, and sometimes
information about the DNS zone.
administrator contact info.
Helps identify hostnames
Maps an IP address to a domain
PTR Pointer Record behind IP addresses and
name (reverse DNS).
internal naming conventions.

19-01-2026 A. ANANDITA IYER 10

 DNS RECORDS COMMONLY ACCESSED DURING
ENUMERATION
DNS Record What It Contains / Why It Is Important in DNS
Full Name
Type Purpose Enumeration
Defines services, Reveals internal services such as
SRV Service Record ports, and hosts (e.g., authentication, messaging, or
LDAP, SIP). directory services.
Specifies which CAs Helps assess TLS trust
Certification Authority
CAA are allowed to issue boundaries and certificate
Authorization
SSL/TLS certificates. misconfigurations.
Used for advanced
Naming Authority Indicates telephony or
NAPTR service discovery
Pointer communication infrastructure.
(VoIP, SIP).
Shows whether DNSSEC is
Contains public keys
DNSKEY DNSSEC Key Record implemented and how keys are
used for DNSSEC.
managed.

19-01-2026 A. ANANDITA IYER 11

 DNS RECORDS COMMONLY ACCESSED DURING
ENUMERATION
DNS Record Why It Is Important in DNS
Full Name What It Contains / Purpose
Type Enumeration
DNSSEC Signature Stores cryptographic signatures Indicates DNSSEC protection
RRSIG
Record for DNSSEC-protected records. and integrity enforcement.
Links child zone to parent zone Helps evaluate DNSSEC
DS Delegation Signer
in DNSSEC. chain of trust.
Stores geographic location of a May reveal physical location
LOC Location Record
domain (rarely used). of servers or infrastructure.
Rare but extremely valuable
Host Information Describes hardware and
HINFO if present, as it reveals OS
Record operating system of a host.
and architecture details.
Can reveal administrative
Specifies contact information for
RP Responsible Person emails useful for social
domain administrators.
engineering.

19-01-2026 A. ANANDITA IYER 12

 DNS ENUMERATION TOOLS
Aspect host nslookup dig
Simple DNS lookup Interactive / command-line Advanced DNS query and
Tool Type
utility DNS query tool analysis tool
Primary Quick and basic DNS Manual DNS querying and Detailed DNS enumeration
Purpose resolution troubleshooting and protocol-level analysis
Very easy; minimal Moderate; supports Advanced; requires DNS
Ease of Use
syntax interactive mode knowledge

Fast checks during early General DNS queries, Professional DNS analysis
Typical Usage
reconnaissance commonly used on Windows and deep enumeration

Output Detail
Minimal and clean Moderate Very detailed and verbose
Level
Default Linux / Unix (can be
Linux / Unix systems Windows, Linux, macOS
Availability installed on Windows)
19-01-2026 A. ANANDITA IYER 13
1. DNS ENUMERATION USING HOST
Example 1: A Record Lookup
host [Link]
The host command is a simple and Sample Output
fast DNS lookup utility commonly [Link] has address [Link]
used during initial enumeration.
What This Reveals
 This output shows the IPv4 address of the server
hosting [Link].
 An ethical hacker now knows the exact IP address to
scan using tools like Nmap.

19-01-2026 A. ANANDITA IYER 14

 1. DNS ENUMERATION USING HOST
Example 2: AAAA (IPv6) Record Lookup Example 3: MX Record Enumeration
host -t AAAA [Link] host -t MX [Link]

Sample Output Sample Output

[Link] has IPv6 address [Link] mail is handled by 10
2606:2800:220:1:248:1893:25c8:1946 [Link].

What This Reveals What This Reveals

 This confirms the organization supports IPv6,  Mail server details are exposed. Attackers
which is often less monitored and may expose can now: Target mail servers directly, Craft
additional attack surfaces. phishing attacks, Test email spoofing
defenses

19-01-2026 A. ANANDITA IYER 15

 2. DNS ENUMERATION USING NSLOOKUP
Example 1: Basic Domain Lookup
nslookup [Link]
Sample Output
Server: [Link]
Address: [Link]#53
nslookup is an interactive DNS Non-authoritative answer:
query tool widely available onName: [Link]
Windows and Linux systems.
Address: [Link]
What This Reveals
 DNS server being used, IP address of the domain. This is often the first
confirmation step before deeper enumeration.

19-01-2026 A. ANANDITA IYER 16

 2. DNS ENUMERATION USING NSLOOKUP
Example 2: Name Server Enumeration Example 3: TXT Record Enumeration
nslookup -type=NS [Link] nslookup -type=TXT [Link]

Sample Output Sample Output

[Link] nameserver = [Link]. [Link] text = "v=spf1
[Link] nameserver = [Link]. include:_spf.[Link] ~all"
[Link] text = "google-site-
What This Reveals verification=abcd1234"
 Name servers indicate:
What This Reveals
 DNS hosting provider
 SPF policy (email spoofing protection)
 Possible misconfigurations
 Cloud or service verification tokens
 Targets for zone transfer testing
 Misconfigured TXT records can help attackers
bypass email security.

19-01-2026 A. ANANDITA IYER 17

 3. DNS ENUMERATION USING DIG
Example 1: A Record Lookup
dig [Link]

Sample Output (Trimmed)

;; ANSWER SECTION:
dig (Domain Information Groper) is the most [Link]. 86400 IN A
detailed DNS enumeration tool and is [Link]
heavily used by professionals. What This Reveals
 IP address
 TTL (Time to Live), indicating DNS caching
behavior

19-01-2026 A. ANANDITA IYER 18

 3. DNS ENUMERATION USING DIG
Example 2: MX Record Enumeration Example 3: TXT Record Enumeration
dig MX [Link] dig TXT [Link]
Sample Output Sample Output
[Link]. 3600 IN MX 10 [Link]. 3600 IN TXT "v=spf1
[Link]. include:_spf.[Link] ~all"
What This Reveals What This Reveals
 Mail server priority and hostnames used for  Email security configuration that attackers
email delivery. analyze for spoofing possibilities.

19-01-2026 A. ANANDITA IYER 19

 3. DNS ENUMERATION USING DIG
Example 4: SOA Record Enumeration
Example 5: Attempting Zone Transfer
dig SOA [Link]
(AXFR)
Sample Output dig AXFR [Link]
[Link]. 86400 IN SOA [Link]. @[Link]
[Link]. (
Secure Configuration Output
2025071501 ; serial
; Transfer failed.
3600 ; refresh Misconfigured Server Output (Dangerous)
1800 ; retry [Link]. IN A [Link]
604800 ; expire
[Link]. IN A [Link]
[Link]. IN A [Link]
86400 ) ; minimum
[Link]. IN A [Link]
What This Reveals
 DNS administrator email (encoded as admin@[Link]) What This Reveals
 Zone update timings  A successful zone transfer exposes all
subdomains and hosts, which is catastrophic
 Change frequency of DNS records
from a security standpoint.

19-01-2026 A. ANANDITA IYER 20

 SOCIAL ENGINEERING ATTACKS: THE EXPLOITATION OF
HUMAN COGNITION
Social engineering attacks exploit the human element of security, which remains the most
complex and least predictable component of any system. Unlike technical vulnerabilities,
human vulnerabilities cannot be patched or fully eliminated. They arise from cognitive
biases, social norms, emotional responses, and organizational culture.
At its foundation, social engineering relies on psychological principles such as authority,
urgency, familiarity, and fear. These principles are deeply rooted in human behavior and
are effective precisely because they align with how people are trained to respond in
professional environments. An employee is conditioned to comply with authority, respond
quickly to urgent requests, and trust familiar internal processes.

19-01-2026 A. ANANDITA IYER 21

 SOCIAL ENGINEERING ATTACKS
Phishing attacks represent the most common manifestation of social engineering, but their
sophistication has increased dramatically. Early phishing attempts relied on poorly written
messages and generic lures. Modern phishing campaigns are highly targeted, personalized, and
context-aware. Attackers leverage competitive intelligence to tailor messages that reference real
projects, internal tools, and organizational events. These attacks often bypass technical defenses
because they appear legitimate to both humans and automated filters.
Advanced social engineering extends beyond email into voice, messaging platforms, and hybrid
attacks. Business Email Compromise attacks have caused unprecedented financial losses by
manipulating internal trust relationships rather than exploiting technical flaws. More recently,
attackers have begun using artificial intelligence to generate realistic voice deepfakes of
executives, instructing employees to authorize urgent transactions. These attacks blur the line
between technical and psychological exploitation, marking a significant evolution in threat
capabilities.

19-01-2026 A. ANANDITA IYER 22

 SOCIAL ENGINEERING ATTACKS
Social engineering demonstrates a fundamental reality of cybersecurity: no technical
control can fully compensate for human deception.
Ethical hacking programs increasingly focus on simulating social engineering attacks to
assess not just system security, but organizational awareness, training effectiveness, and
incident response maturity.
Organizations that treat social engineering as a secondary concern remain highly
vulnerable, regardless of their technical defenses.

19-01-2026 A. ANANDITA IYER 23

 TYPES OF SOCIAL ENGINEERING ATTACKS
1. Phishing
Phishing is the most common social engineering attack, where attackers send deceptive
emails that appear to come from legitimate organizations to trick users into revealing
credentials, clicking malicious links, or downloading malware. Modern phishing emails closely
mimic real brands, use correct logos and language, and often create urgency such as
“account suspension” or “password expiry.” Real-world phishing attacks frequently target
banking customers, cloud service users, and corporate employees.
2. Spear Phishing
Spear phishing is a targeted form of phishing aimed at a specific individual or group.
Attackers use personal details such as job role, manager name, or ongoing projects
gathered from OSINT. Because the message is personalized, it is far more convincing than
generic phishing. Many enterprise breaches begin with a single spear-phishing email sent to
an IT administrator or finance employee.
19-01-2026 A. ANANDITA IYER 24
 TYPES OF SOCIAL ENGINEERING ATTACKS
3. Impersonation
In impersonation attacks, attackers pretend to be someone the victim trusts, such as a
coworker, vendor, or authority figure. This may occur via email, phone, or in person.
Physical impersonation has been used to gain access to offices by posing as delivery
staff or maintenance personnel.
4. Tailgating (Piggybacking)
Tailgating is a physical social engineering attack where an unauthorized person gains
access to a restricted area by following an authorized individual. Attackers exploit
politeness and social norms, such as holding doors open. Many corporate offices have
been compromised through tailgating despite strong digital security.

19-01-2026 A. ANANDITA IYER 25

 TYPES OF SOCIAL ENGINEERING ATTACKS
5. Baiting
Baiting involves offering something enticing to lure victims into a trap. This could be a free
download, pirated software, or an infected USB drive labeled “Salary Details” or
“Confidential.” Once accessed, malware is installed. This attack exploits human curiosity
and greed.
6. Scareware
Scareware uses fear to manipulate victims, often through fake pop-ups claiming malware
infection or legal trouble. Victims are pressured into installing fake security software or
paying money. These attacks are common on malicious websites and fake advertisements.

19-01-2026 A. ANANDITA IYER 26

 TYPES OF SOCIAL ENGINEERING ATTACKS
7. Honey Trap
Honey trap attacks involve building emotional relationships to manipulate victims into
sharing information or money. In corporate espionage, attackers may use fake online
identities to build trust with employees and extract sensitive data over time.
8. Watering Hole Attack
In a watering hole attack, attackers compromise a website frequently visited by a specific
group and inject malicious content. Victims become infected simply by visiting the trusted
site. This method has been used in targeted attacks against government agencies and
industry-specific organizations.

19-01-2026 A. ANANDITA IYER 27

 SCANNING AND ENUMERATION: CONVERTING
KNOWLEDGE INTO TECHNICAL CONTROL
Scanning and enumeration represent the transition from intelligence gathering to direct
interaction with systems. This phase transforms abstract knowledge into concrete technical
understanding. While earlier stages identify what might exist, scanning confirms what is
reachable, and enumeration explains how it behaves.
At a basic level, scanning identifies live systems, open ports, and accessible services. This
information defines the technical attack surface. Every exposed service represents a potential
vulnerability, whether through outdated software, weak authentication, or misconfiguration.
Scanning validates assumptions formed during competitive intelligence and DNS enumeration,
grounding strategy in observable reality.

19-01-2026 A. ANANDITA IYER 28

 SCANNING AND ENUMERATION
Enumeration builds on scanning by extracting detailed, structured information from
identified services. Instead of simply detecting that a service exists, enumeration reveals
software versions, authentication mechanisms, user roles, access permissions, and trust
relationships. This level of detail is essential because most vulnerabilities are not universal;
they are specific to configurations, versions, and operational context.
In modern infrastructures, scanning and enumeration must adapt to dynamic environments.
Cloud instances, containers, serverless functions, and APIs introduce new enumeration targets
that do not behave like traditional servers. Ethical hackers now enumerate identity services,
API endpoints, cloud metadata services, and access tokens rather than just ports and
protocols.

19-01-2026 A. ANANDITA IYER 29

 SCANNING AND ENUMERATION
Real-world attack investigations consistently show that enumeration is the stage where
breaches escalate from initial access to full compromise. Attackers who enumerate
successfully understand where sensitive data resides, how authentication flows work, and
which systems control backups and monitoring. This knowledge allows them to maximize
impact while minimizing detection.
From a defensive standpoint, scanning and enumeration reinforce the importance of attack
surface reduction, network segmentation, and continuous monitoring. Organizations that
understand their own environments as thoroughly as attackers do are far better positioned
to detect anomalies and respond effectively.

19-01-2026 A. ANANDITA IYER 30

 SCANNING AND ENUMERATION
Scanning and enumeration are critical phases in the ethical hacking lifecycle that
bridge the gap between passive information gathering and active exploitation.
While earlier stages such as reconnaissance and competitive intelligence focus on
collecting information without direct interaction, scanning and enumeration involve
directly communicating with target systems to discover what is actually reachable,
how it behaves, and what weaknesses may exist.
These phases convert assumptions into verified technical knowledge and are
fundamental to understanding an organization’s true attack surface.

19-01-2026 A. ANANDITA IYER 31

 SCANNING

At its core, scanning is the process of identifying live hosts, open ports, and running
services on a target network.
The fundamental purpose of scanning is to answer basic but essential questions:
Which systems are online? Which services are exposed? Which entry points exist?
Without scanning, an attacker or ethical hacker operates blindly.
From a networking perspective, scanning relies on how systems respond to network
requests. When a packet is sent to a host or port, the response, or lack of
response reveals information about the system’s state.

19-01-2026 A. ANANDITA IYER 32

 SCANNING
This interaction is governed by protocols such as TCP, UDP, and ICMP. For example,
a TCP response indicating a port is open suggests that a service is actively
listening, whereas a closed or filtered response indicates restricted access or
firewall protection.
Scanning is inherently more intrusive than reconnaissance because it touches the
target systems directly.
However, ethical hackers perform scanning in a controlled and authorized manner
to map exposure without disrupting services.

19-01-2026 A. ANANDITA IYER 33

 TYPES OF SCANNING

Scanning can be broadly classified into network scanning, port scanning, and
vulnerability scanning, each serving a distinct purpose.

Network scanning focuses on identifying which hosts are alive within a given IP
range. This is often achieved through ICMP echo requests or TCP-based techniques
when ICMP is blocked. Network scanning establishes the scope of systems that can
potentially be attacked or defended.

19-01-2026 A. ANANDITA IYER 34

 TYPES OF SCANNING
Port scanning builds on this by identifying which ports are open on those live hosts.
Each open port corresponds to a service such as web servers, mail servers,
databases, or remote access protocols. Port scanning is essential because services not
systems themselves are usually exploited. An unused or closed port does not present
an immediate attack vector.
Vulnerability scanning goes a step further by comparing identified services and
versions against known vulnerability databases. While this provides an overview of
potential weaknesses, it does not confirm exploitability. Ethical hackers use
vulnerability scanning as a prioritization tool rather than definitive proof of
compromise.

19-01-2026 A. ANANDITA IYER 35

 EVOLUTION OF SCANNING IN MODERN ENVIRONMENTS
In traditional networks, scanning involved static IP ranges and long-lived servers.
Modern infrastructures, however, are highly dynamic. Cloud computing,
containerization, and microservices have changed the nature of scanning significantly.
Systems appear and disappear rapidly, IP addresses change frequently, and
services are often exposed through APIs rather than fixed ports.
As a result, modern scanning must account for cloud-native components such as load
balancers, virtual networks, identity services, and API gateways. Ethical hackers now
scan not only networks but also cloud configurations, identity endpoints, and
management interfaces. This evolution has made scanning more complex and more
critical than ever.

19-01-2026 A. ANANDITA IYER 36

 ENUMERATION
Enumeration is the process of extracting detailed, structured information from
systems discovered during scanning.
While scanning answers the question “What is there?”, enumeration answers “How
does it work, and who can access it?”.
Enumeration transforms surface-level discovery into actionable intelligence.
At a basic level, enumeration involves identifying service banners, protocol
versions, and basic configuration details.

19-01-2026 A. ANANDITA IYER 37

 ENUMERATION
For example, knowing that a web server is running is useful, but knowing its exact
version and enabled modules is far more valuable. Enumeration reveals this depth
of information.
Enumeration often targets specific services such as web servers, file-sharing
services, directory services, databases, and authentication systems.
Each service leaks different kinds of information depending on its configuration
and security posture.

19-01-2026 A. ANANDITA IYER 38

 USER AND RESOURCE ENUMERATION

One of the most critical aspects of enumeration is user and resource discovery.
Many systems inadvertently reveal valid usernames, group memberships, shared
resources, and access permissions.
This information dramatically reduces the effort required for later attacks such as
password guessing, privilege escalation, or lateral movement.
For example, directory services may reveal domain users, file servers may expose shared
directories, and web applications may disclose user roles through error messages or API
responses.
In real-world attacks, enumeration of users and privileges often determines whether an
attack escalates beyond initial access.

19-01-2026 A. ANANDITA IYER 39

 ENUMERATION IN AUTHENTICATION AND
AUTHORIZATION SYSTEMS
Modern systems rely heavily on identity and access management. Enumeration in this
context focuses on how authentication is performed and how authorization decisions are
enforced.
Weaknesses such as verbose error messages, inconsistent access checks, or misconfigured
roles often surface during enumeration.
In many breaches, attackers did not exploit software bugs but instead enumerated
permissions and discovered that certain users or services had more access than intended.
This highlights that enumeration is not merely technical but also logical, requiring an
understanding of system design and trust relationships.

19-01-2026 A. ANANDITA IYER 40

 REAL-WORLD IMPORTANCE OF SCANNING AND
ENUMERATION
Most real-world cyberattacks succeed not because attackers use advanced exploits, but
because scanning and enumeration reveal weak points that defenders overlooked. Many
ransomware incidents began with exposed remote access services discovered during
scanning, followed by enumeration that revealed administrative privileges or backup
systems.
From a defensive standpoint, understanding scanning and enumeration is essential for
attack surface management. Organizations that continuously scan and enumerate their
own environments are far less likely to be surprised by attackers.
Security teams increasingly adopt the mindset of “assume breach” and use enumeration
defensively to identify what an attacker would see after gaining access.

19-01-2026 A. ANANDITA IYER 41

 RELATIONSHIP BETWEEN SCANNING, ENUMERATION, AND
EXPLOITATION
Scanning and enumeration do not exist in isolation. They form a logical progression
toward exploitation.
Scanning identifies targets, enumeration prioritizes them, and exploitation attempts to
compromise them.
Weak scanning leads to missed targets, weak enumeration leads to ineffective
exploitation, and strong enumeration often makes exploitation trivial.
Ethical hacking emphasizes mastering scanning and enumeration because they
provide the highest return on investment. A well-enumerated system often reveals
misconfigurations that require no exploit at all.

19-01-2026 A. ANANDITA IYER 42

 TYPES OF SCANNING
As previously discussed, there are three major scanning types;
 Network Scanning
 Port Scanning
 Vulnerability Scanning
These are core technical activities in ethical hacking that collectively define how attackers
and defenders understand the exposure of a system or organization. These scanning
techniques convert abstract infrastructure into a measurable attack surface and form the
basis for both offensive security testing and defensive risk management. Although often
grouped together, each type of scanning serves a distinct purpose and operates at a
different level of depth.

19-01-2026 A. ANANDITA IYER 43

 NETWORK SCANNING: DISCOVERING LIVE SYSTEMS
Network scanning is the foundational step in active reconnaissance. Its primary goal is to
identify which hosts are alive within a given IP address range. Before an attacker or
ethical hacker can target services or vulnerabilities, they must first determine whether a
system actually exists and is reachable.
At a basic level, network scanning relies on network protocols to infer host availability.
Traditional methods use ICMP echo requests, commonly known as “ping,” to check whether
a host responds. If a response is received, the host is considered alive. However, modern
networks often block ICMP traffic for security reasons, which has led to more advanced
techniques such as TCP-based host discovery. In these methods, probes are sent to
common ports, and responses are analysed to determine host availability even when
ICMP is disabled.

19-01-2026 A. ANANDITA IYER 44

 NETWORK SCANNING: DISCOVERING LIVE SYSTEMS
Network scanning establishes the scope of assessment. In enterprise environments, this
may involve thousands of IP addresses spread across multiple subnets, cloud regions, or
virtual networks. In modern cloud infrastructures, network scanning is more complex
because IP addresses are dynamic and systems may exist only temporarily. As a result,
network scanning must be continuous rather than a one-time activity.
From a defensive perspective, network scanning highlights the importance of asset
visibility. Organizations that do not know which systems are live cannot effectively secure
them. Many breaches occur because forgotten or shadow IT systems were never included
in security monitoring.

19-01-2026 A. ANANDITA IYER 45

 WHAT ARE PORTS IN NETWORKING?
Whenever any application in one computer sends data to another application of a
different computer then it sends using IP Address and MAC Address but how does our
computer know that this data is for a specific application and this data is sent by any
specific application? There comes the concept of Port.
For instance, imagine your MAC Address or IP Address as the PIN code of the nearest
Post Office and your house address as a Port. Whenever any parcel is sent to you it gets
received by the nearest post office and then it is identified by your address where to
deliver that parcel. Similarly in a computer data is first received using their IP or MAC
address then it is delivered to the application whose port number is with the data
packets.

19-01-2026 A. ANANDITA IYER 46

 WHAT ARE PORTS IN NETWORKING?
Port is a logical address of a 16-bit unsigned integer that is allotted to every
application on the computer that uses the internet to send or receive data.

Now every time any application sends any data, it is identified by the port that
which the application sent that data and the data is to be transferred to the
receiver application according to its port. We often call port as port number.

19-01-2026 A. ANANDITA IYER 47

 TYPES OF PORTS
Ports are further divided into three categories:
 Well Known Port
 Registered port
 Dynamic Port

Well Known Port: It is from the range 0 to 1023. It is reserved for common and
specifically used service. It is used by some widely adopted protocols and services
like HTTP(port 80), FTP(port 21), DNS(Port 53), SSH(port 22), etc....

19-01-2026 A. ANANDITA IYER 48

 TYPES OF PORTS
Registered Port: It is from range 1024 to 49151. These are used by applications or
services that are not as common. But it is used by those applications or services which
require its specific port. Organizations can ask IANA(Internet Assigned Number
Authority) for any specific port number within this range
Dynamic Port: It is from range 49152 to 65535. It is also known as Ephemeral or
Private Port. It is used for those connections that are temporary or short-lived. It is not
registered or assigned and can be used by any process

19-01-2026 A. ANANDITA IYER 49

 SOME POPULAR PORT NUMBERS

19-01-2026 A. ANANDITA IYER 50

 PORT SCANNING: IDENTIFYING ENTRY POINTS
Port scanning builds directly on network scanning by identifying which ports
are open on live hosts. Each open port corresponds to a service or application
listening for connections. Because most cyberattacks target services rather than
operating systems directly, port scanning is one of the most critical phases of
ethical hacking.
At a foundational level, port scanning is based on the behavior of the TCP and
UDP protocols. When a probe is sent to a port, the response indicates whether
the port is open, closed, or filtered. An open port means a service is actively
listening and potentially exploitable. A closed port indicates no service is
present, while a filtered port suggests the presence of a firewall or access
control.

19-01-2026 A. ANANDITA IYER 51

 PORT SCANNING: IDENTIFYING ENTRY POINTS
Different port scanning techniques exist to balance speed, accuracy, and
stealth.
Basic TCP connect scanning establishes full connections to ports, making it
reliable but easily detectable.
More advanced techniques, such as SYN scanning, analyze partial
connections to infer port states while minimizing logging.
UDP scanning is more complex because UDP does not provide clear
responses, making results slower and less reliable.

19-01-2026 A. ANANDITA IYER 52

 PORT SCANNING: IDENTIFYING ENTRY POINTS
In real-world attacks, exposed remote access ports such as SSH, RDP, or VPN
services are frequently identified through port scanning and then targeted
using credential attacks or exploitation. Many ransomware incidents began
with nothing more than an open port discovered through automated scanning.
Port scanning is not limited to identifying ports alone. It also provides clues
about service purpose. For example, open ports commonly associated with
web servers, email servers, databases, or remote administration reveal how a
system is intended to be accessed. This knowledge allows attackers and ethical
hackers to prioritize targets based on potential impact.

19-01-2026 A. ANANDITA IYER 53

 SERVICE AND VERSION DETECTION: EXTENDING PORT
SCANNING
Modern port scanning goes beyond identifying open ports to determining what
services and versions are running. This extension is critical because vulnerabilities
are typically version-specific. Knowing that a web server exists is far less useful
than knowing its exact software and patch level.
Service detection works by sending carefully crafted requests to open ports and
analyzing responses, banners, and protocol behavior.
This process often reveals server software, operating system details, and enabled
features. While this information is invaluable for vulnerability analysis, it must be
handled carefully in ethical hacking to avoid service disruption.
Service enumeration through port scanning often exposes misconfigurations, such as
default banners revealing internal system details or outdated software versions still
in use. These findings frequently lead directly to successful exploitation without the
need for advanced attack techniques.
19-01-2026 A. ANANDITA IYER 54
VULNERABILITY SCANNING: IDENTIFYING KNOWN WEAKNESSES

Vulnerability scanning represents a higher-level form of scanning that focuses

on identifying known security weaknesses rather than simply exposed
services. It compares discovered systems, services, and configurations against
databases of known vulnerabilities, misconfigurations, and insecure practices.
At a basic level, vulnerability scanners automate what would otherwise be a
manual process of checking software versions and configurations against
public vulnerability disclosures.
The output typically includes vulnerability identifiers, severity scores, and
remediation recommendations. This makes vulnerability scanning a powerful
tool for risk assessment and prioritization.

19-01-2026 A. ANANDITA IYER 55

VULNERABILITY SCANNING: IDENTIFYING KNOWN WEAKNESSES
However, vulnerability scanning does not prove exploitability.
Many reported vulnerabilities are theoretical, context-dependent, or mitigated
by environmental controls. As a result, vulnerability scanning is best viewed as
a diagnostic and prioritization tool, not definitive proof of compromise.
In modern environments, vulnerability scanning has expanded to include cloud
services, container images, APIs, and identity configurations. Misconfigured
storage buckets, overly permissive access policies, and exposed management
interfaces are now as significant as traditional software vulnerabilities. This
shift reflects the changing nature of enterprise infrastructure.

19-01-2026 A. ANANDITA IYER 56

 ADVANCED VULNERABILITY SCANNING AND CONTINUOUS
ASSESSMENT
As cyber threats have become more sophisticated, vulnerability scanning has evolved
toward continuous assessment. Rather than running periodic scans, organizations
increasingly integrate vulnerability scanning into development pipelines and runtime
environments. This approach enables early detection of vulnerabilities before systems
are deployed and continuous monitoring after deployment.
Advanced vulnerability scanning also incorporates contextual analysis, such as asset
criticality and exposure. A vulnerability on an internal test system may be low risk,
while the same vulnerability on an internet-facing production system may be critical.
Modern scanners attempt to provide this context, but human judgment remains
essential.
Attackers exploit the same vulnerabilities identified by scanners, but they often move
faster than defenders. Many breaches occur within days of vulnerability disclosure,
highlighting the importance of rapid scanning and remediation.
19-01-2026 A. ANANDITA IYER 57
 SCANNING TOOLS IN ETHICAL HACKING
Scanning tools are software utilities designed to actively interact with networks,
hosts, and services in order to discover live systems, exposed ports, running
services, and known vulnerabilities.
While reconnaissance focuses on information that can be collected without
touching the target, scanning tools deliberately send packets and requests to
targets and analyze the responses. For this reason, scanning tools represent the
transition from passive observation to active assessment.
In ethical hacking, scanning tools are used in a controlled and authorized
manner to simulate how real attackers discover weaknesses. In defensive
security, the same tools are used to understand exposure and reduce risk. The
difference lies in intent, scope, and remediation.
19-01-2026 A. ANANDITA IYER 58
 NETWORK SCANNING TOOLS
Network scanning tools are primarily concerned with host discovery. Their
goal is to determine which systems are alive and reachable within a given IP
address range. Before ports or vulnerabilities can be examined, it must be
established that a system actually exists.
At a basic level, network scanning tools rely on protocols such as ICMP, TCP,
and ARP to infer host availability. Traditional tools used simple ICMP echo
requests, but modern networks frequently block ICMP, requiring more
advanced techniques.
Most common used network scanning tools are:
Nmap
Masscan
19-01-2026 A. ANANDITA IYER 59
 PORT SCANNING TOOLS
Port scanning tools focus on identifying open ports and exposed services on
live hosts. Each open port represents a potential entry point, and most attacks
target services rather than operating systems directly.
Port scanning tools do more than identify ports; they also perform service and
version detection. This capability allows the scanner to determine which
application is running on a port and which version it is using. This is critical
because vulnerabilities are often version-specific.
Most common used port scanning tools are:
Nmap
Netcat
19-01-2026 A. ANANDITA IYER 60
 VULNERABILITY SCANNING TOOLS
Vulnerability scanning tools represent the next layer of scanning, focusing on
identifying known security weaknesses rather than simply exposed services.
These tools compare discovered systems, services, and configurations against
vulnerability databases and security best practices.
Most common used vulnerability scanning tools are:
 Nessus
 OpenVas
Modern vulnerability scanning tools such as:
 Qualys
 Rapid7 InsightVM

Vulnerability scanning identify potential weaknesses, not confirmed exploits. False

positives are common, and context matters.
19-01-2026 A. ANANDITA IYER 61
 1. NMAP (NETWORK MAPPER)
Nmap is the most widely used and versatile scanning tool in ethical hacking. It
is designed to discover hosts, open ports, services, operating systems, and
security configurations across networks. Nmap operates by sending carefully
crafted packets to target systems and analyzing their responses. The behavior
of these responses is governed by TCP/IP protocol rules, which Nmap
leverages to infer system states.
At a basic level, Nmap performs host discovery by checking whether systems
are alive. It does this using ICMP echo requests or TCP-based probes when
ICMP is blocked. Once live hosts are identified, Nmap moves to port scanning,
determining which ports are open, closed, or filtered. This reveals which
services are accessible on the network.

19-01-2026 A. ANANDITA IYER 62

 1. NMAP (NETWORK MAPPER)
Nmap becomes particularly powerful with service and version detection. Instead of
just stating that port 80 is open, Nmap can identify that it is running a specific version
of Apache or Nginx. This information is critical because vulnerabilities are often tied to
exact software versions.
At an advanced level, Nmap includes the Nmap Scripting Engine (NSE). NSE scripts
allow Nmap to perform deeper enumeration, such as detecting weak authentication,
checking for known vulnerabilities, enumerating users, or identifying misconfigurations.
These scripts bridge the gap between scanning and vulnerability assessment.
In real-world attacks, Nmap is often the first active tool used after reconnaissance.
Many ransomware campaigns begin with Nmap scans that identify exposed remote
access services like RDP or SSH. In ethical hacking, Nmap helps defenders understand
what attackers can see and close unnecessary entry points.
19-01-2026 A. ANANDITA IYER 63
 2. MASSCAN
Masscan is a high-speed network scanner designed for scale rather than depth. While
Nmap focuses on accuracy and detail, Masscan prioritizes speed. It can scan entire IP
address ranges in seconds or minutes, making it suitable for very large environments.
Masscan works by asynchronously sending TCP SYN packets at extremely high rates and
listening for responses. It does not wait for replies before sending more packets, which
allows it to scan millions of addresses quickly. This makes it ideal for identifying hosts and
open ports across massive networks.
However, Masscan does not perform deep service detection or enumeration. Its purpose is
to answer the question: “Which IP addresses have this port open?” Once that is known,
more detailed tools like Nmap are typically used for further analysis.
In real-world research and large-scale security assessments, Masscan is used to identify
internet-wide exposure, such as how many systems are running a vulnerable service.
Because of its speed and noisiness, it must be used carefully and only with proper
authorization.
19-01-2026 A. ANANDITA IYER 64
3. NETCAT
Netcat is often referred to as the “Swiss army knife” of networking because of its flexibility.
Unlike Nmap and Masscan, Netcat is not an automated scanner. Instead, it allows manual
interaction with network ports, making it extremely useful for validation and enumeration.
At a basic level, Netcat can connect to a specific port and display raw responses from a
service. This helps ethical hackers understand how a service behaves when receiving input.
For example, connecting to a web server or mail server using Netcat may reveal banners,
protocol details, or error messages.
Netcat is also used to test whether a port identified as open by a scanner is actually
accessible and responsive. This manual verification is important because automated scanners
can sometimes misinterpret filtered or rate-limited ports.
In advanced scenarios, Netcat is used for custom data transfer, reverse shells, and port
listening. While these uses extend beyond scanning, they demonstrate why Netcat is a
valuable tool during enumeration and exploitation preparation.
In real-world engagements, Netcat is commonly used after Nmap to interact with discovered
services
19-01-2026 and confirm findings before proceeding further. A. ANANDITA IYER 65
4. NESSUS
Nessus is one of the most widely used vulnerability scanning tools in the industry.
Unlike Nmap, which focuses on discovery, Nessus focuses on identifying known
security weaknesses by comparing system information against a large vulnerability
database.
Nessus works by scanning systems for missing patches, insecure configurations,
outdated software, weak encryption, and known vulnerabilities identified by CVEs. It
uses plugins that are updated frequently to reflect newly discovered vulnerabilities.
At a basic level, Nessus provides a list of detected vulnerabilities along with severity
ratings and remediation guidance. This makes it especially useful for organizations
that need to prioritize risk and demonstrate compliance.

19-01-2026 A. ANANDITA IYER 66

NESSUS
At an advanced level, Nessus supports authenticated scans, where it logs
into systems with provided credentials to perform deeper inspection.
Authenticated scans provide far more accurate results because they can
inspect internal configurations rather than relying solely on external
probing.
In real-world security operations, Nessus is used for regular vulnerability
assessments. Many organizations run Nessus scans weekly or monthly to
identify new risks. Ethical hackers use Nessus to quickly identify low-
hanging fruit before manual testing.

19-01-2026 A. ANANDITA IYER 67

 5. OPENVAS
OpenVAS is an open-source vulnerability scanning framework that provides
functionality similar to Nessus. It performs network-based vulnerability
assessments by scanning systems and comparing results against known
vulnerability databases.
OpenVAS is widely used in academic environments, research, and organizations
that prefer open-source solutions. It demonstrates that enterprise-level vulnerability
scanning is not limited to proprietary tools.
OpenVAS supports both unauthenticated and authenticated scans and provides
detailed reports on discovered vulnerabilities. Like Nessus, it identifies potential
weaknesses but does not confirm exploitability.
In practice, OpenVAS is often used as a cost-effective alternative for learning
vulnerability scanning concepts and conducting internal assessments. Ethical hackers
must still manually verify results to eliminate false positives.
19-01-2026 A. ANANDITA IYER 68
 6. QUALYS
Qualys is a cloud-based vulnerability management platform rather than a
standalone scanner. It integrates asset discovery, vulnerability detection,
compliance monitoring, and risk prioritization into a single system.
Qualys operates continuously, scanning environments as they change. This is
particularly important in cloud environments where assets are dynamic and
traditional periodic scanning may miss short-lived systems.
In advanced use, Qualys correlates vulnerabilities with asset criticality and
exposure, helping organizations prioritize remediation based on real-world risk.
This reflects the modern shift from simple vulnerability detection to comprehensive
vulnerability management.
Large enterprises use Qualys to maintain visibility across thousands of systems
and demonstrate regulatory compliance.
19-01-2026 A. ANANDITA IYER 69
 7. RAPID7 INSIGHTVM
Rapid7 InsightVM is another advanced vulnerability management tool that
emphasizes real-time visibility and risk-based prioritization. It integrates
vulnerability scanning with threat intelligence to identify which vulnerabilities
are actively exploited in the wild.
InsightVM provides live dashboards and integrates with ticketing and incident
response systems, allowing organizations to move from detection to
remediation quickly.
In modern security operations, InsightVM is valued for its ability to
contextualize vulnerabilities rather than simply listing them. Ethical hackers and
defenders use this context to focus efforts where they matter most.

19-01-2026 A. ANANDITA IYER 70

 OPERATING SYSTEM AND FINGERPRINTING
ENUMERATION
Operating System and fingerprinting enumeration is a critical phase in ethical
hacking and cybersecurity assessment that focuses on identifying the operating
system, platform characteristics, and behavioral traits of a target system.
While scanning reveals which hosts and services are accessible, fingerprinting
reveals what type of system is behind those services and how it behaves
at a low level. This information significantly influences attack strategy, tool
selection, and defensive planning.
At its core, OS fingerprinting answers a fundamental question: What system am
I communicating with? The answer may include whether the target is running
Windows, Linux, macOS, a network appliance, an embedded system, or a
cloud-managed platform, along with version and configuration details.

19-01-2026 A. ANANDITA IYER 71

 OS FINGERPRINTING
Every operating system implements network protocols slightly differently. Although
protocols such as TCP/IP are standardized, operating systems vary in how they set
default values, handle edge cases, and respond to unexpected input. These subtle
differences create a behavioral signature, often referred to as a fingerprint.
OS fingerprinting leverages these differences by observing how a system responds to
network probes. For example, the way a system replies to a TCP packet with unusual
flags or how it handles fragmented packets can reveal the underlying operating
system. This concept is analogous to identifying a person by their handwriting or gait
small variations reveal identity even when the overall behavior appears similar.
Fingerprinting is passive or active depending on how information is collected. Passive
fingerprinting observes traffic naturally generated by the target without interacting
directly, while active fingerprinting sends specific probes to elicit identifiable responses.
19-01-2026 A. ANANDITA IYER 72
 PASSIVE OS FINGERPRINTING
Passive OS fingerprinting involves identifying an operating system by
observing network traffic without sending any probes. This method relies on
analyzing packets already being transmitted by the target, such as HTTP
requests, TCP handshakes, or application-layer communications.
At the TCP/IP level, passive fingerprinting examines parameters such as initial
TTL (Time To Live) values, TCP window sizes, sequence number patterns, and
options ordering. Different operating systems use different default values for
these parameters. For example, many Linux systems historically use an initial
TTL of 64, while Windows systems often use 128. By observing a packet’s TTL
and calculating how many hops it has traveled, an analyst can infer the likely
operating system.

19-01-2026 A. ANANDITA IYER 73

 PASSIVE OS FINGERPRINTING
At the application level, passive fingerprinting may involve analyzing HTTP
headers. Web servers often reveal information through headers such as Server
or X-Powered-By. Even when such headers are hidden, subtle differences in
response formatting, error messages, or protocol compliance can reveal
platform details.
Passive fingerprinting is stealthy and difficult to detect, making it attractive to
attackers. However, it requires access to live traffic and may be limited by
encryption, such as HTTPS, which hides application-layer details.

19-01-2026 A. ANANDITA IYER 74

 ACTIVE OS FINGERPRINTING
Active OS fingerprinting involves sending specially crafted packets to a
target system and analyzing the responses. This method is more reliable than
passive fingerprinting but is also more intrusive and easier to detect.
Active fingerprinting techniques exploit the fact that operating systems
respond differently to unusual or malformed packets. For example, sending a
TCP packet with invalid flag combinations may trigger distinct error responses
depending on the OS. Similarly, fragmented packets or unexpected sequence
numbers can elicit responses that reveal OS-specific behavior.

19-01-2026 A. ANANDITA IYER 75

 ACTIVE OS FINGERPRINTING
Tools such as Nmap use extensive databases of known fingerprints collected
from real systems. When Nmap performs OS detection, it sends a series of
probes and compares the responses to its fingerprint database. A close match
results in an OS identification with a confidence score.
Active fingerprinting is particularly useful during penetration testing because it
provides accurate results even when little traffic is available. However, it may
trigger intrusion detection systems or firewalls, making stealth a concern in
real-world attack scenarios.

19-01-2026 A. ANANDITA IYER 76

 SYSTEM HACKING – PASSWORD
In ethical hacking, the term system hacking (passwords) refers to the techniques
used to test the strength and security of password-based authentication on
systems such as desktops, servers, network devices, and enterprise environments.
Passwords remain one of the most widely used authentication methods in the world
because they are easy to implement and inexpensive. However, they also remain
one of the most frequently abused weaknesses because humans choose predictable
passwords, reuse them across services, and often fail to protect them properly.
When penetration testers assess password security, they are not simply trying to
“guess a password.” Instead, they evaluate a complete authentication ecosystem
that includes password creation, storage, transmission, verification, policy
enforcement, and recovery mechanisms. A password is only one part of the security
chain. In modern attacks, passwords are often compromised not by brute force but
by leaks, phishing, misconfigurations, poor hashing, weak policies, and
credential reuse.
19-01-2026 A. ANANDITA IYER 77
 PASSWORD
A password is a secret value used to prove identity. When a user enters a
password into a login system, the system must verify that the provided
password matches the registered secret for that account. This verification
happens in one of two broad ways:
 Plaintext (Insecure, legacy systems)
 Hash-based (Standard secure approach)

19-01-2026 A. ANANDITA IYER 78

 HOW AUTHENTICATION WORKS
Plaintext (Insecure, legacy systems)
In extremely insecure systems, passwords may be stored in plaintext. This means if
an attacker gets access to the database or file, they can instantly read every
password. Modern security best practices strongly forbid this approach.
Hash-based (Standard secure approach)
In secure systems, passwords are stored as hashes, not readable passwords. A
hash is the output of a one-way function, meaning it is easy to compute but
extremely difficult to reverse. When a user logs in, the system hashes the entered
password and compares it to the stored hash. If both hashes match, login
succeeds.
A key point is that the system never needs to know the original password after
registration it only needs a way to validate it.
19-01-2026 A. ANANDITA IYER 79
 WHY PASSWORDS STILL FAIL (HUMAN + SYSTEM
WEAKNESSES)
Password security fails for two major reasons: human behavior and system
design mistakes.
Human password behavior tends to be weak because people choose
memorable passwords, often built from names, dates, or simple patterns.
Password reuse is especially dangerous. If a password is leaked from one
website, attackers try it on email, banking, corporate logins, and cloud
services. This behavior fuels one of the most dominant modern attack
models: credential stuffing.
System design mistakes include poor password storage methods, weak
hashing algorithms, lack of rate limiting, no multi-factor authentication, poor
password reset logic, and insecure authentication configurations.
19-01-2026 A. ANANDITA IYER 80
 ATTACK SURFACE
To understand password hacking, you must understand where passwords exist
in a system’s lifecycle.
During input
Passwords are typed into a login form, remote desktop, terminal login, or VPN
client. If the input device is compromised (for example through malware or
keylogging), the password can be stolen even if it is strong.
During transmission
If passwords are transmitted over insecure channels (like HTTP instead of
HTTPS, or weak network authentication methods), they can be intercepted
using sniffing tools. Modern systems use TLS encryption, but misconfigurations
still exist.
19-01-2026 A. ANANDITA IYER 81
ATTACK SURFACE
Storage
Stored passwords may exist in:
 OS credential stores
 browser password managers
 local config files
 databases
 backups
 authentication logs
 memory (temporarily)
This is where a large portion of credential compromise occurs attackers aim to
steal stored credentials rather than cracking them.
19-01-2026 A. ANANDITA IYER 82
 PASSWORD ATTACKS IN SYSTEM HACKING
Brute Force
In a brute force attack, hackers literally attempt to “beat down the doors” of
user accounts by employing a computer program to quickly run through as many
number and letter combinations as possible. Some attacks begin by trying
common passwords and move on to more complicated phrases; others
methodically try every conceivable password combination until the correct one is
found.
Dictionary Attack
Using a base “dictionary” of likely passwords, hackers attempt to log into one or
more user accounts on a network. The only reason this kind of attack works is
because users continue to rely on easy-to-guess words for their login credentials,
making the job of password cracking simple for malicious third parties. If
hackers gain access to one account, they may be able to glean information
allowing them to access other user accounts.
19-01-2026 A. ANANDITA IYER 83
 PASSWORD ATTACKS IN SYSTEM HACKING
Credential Stuffing
Credential stuffing attacks prove the dangers of re-using the same credentials for
numerous accounts. Even after passwords and other details are reset following a breach,
hackers may attempt to use previously stolen credentials to obtain access to users’ accounts
on other platforms. Hackers also sell lists of stolen passwords to each other, which can
result in widespread malicious activity and increase breach risk across networks.
Social Engineering
Phishing remains the number one social engineering method used by hackers. Employees
receive apparently legitimate messages from someone else in the company, often with a
link to click, a file to download or a request for login information. Responding to these
emails results in either malware being installed on the network or credentials being stolen.
Hackers may also try offline techniques, such as making phone calls and posing as
someone from the IT department asking for password information to help fix a technical
problem.
19-01-2026 A. ANANDITA IYER 84
 PASSWORD ATTACKS IN SYSTEM HACKING
Traffic Interception
Data traveling across networks is vulnerable to the packet sniffers hackers use to
monitor and log traffic. Any password data the sniffers obtain could potentially allow
for unauthorized network access. In some cases, hackers can use additional tools to
decipher encrypted passwords, thus undermining the usefulness of encryption as a
security tool.
Password Spraying
Instead of trying multiple passwords to access a single account, password spraying
attacks involve using common passwords to attempt logins across numerous accounts.
It’s a slow, steady attack method, which allows hackers to work around the account
lockouts normally triggered after repeated failed logins. Password spraying is
becoming more common and is often used to target single sign-on (SSO) accounts,
cloud-based applications and email accounts. By targeting these specific areas,
hackers can obtain more widespread access to networks and compromise or steal a
19-01-2026 A. ANANDITA IYER 85
greater amount of data.
 PASSWORD ATTACKS IN SYSTEM HACKING
Rainbow Table
Hashing passwords is generally recognized as a reliable security practice, but
rainbow table attacks threaten its effectiveness. Using compilations of hash
values for known algorithms, hackers are able to systematically work through
all possible hashes until the correct one is found. This requires a significant
amount of computing power and isn’t guaranteed to succeed in cracking
hashed passwords, but its existence should alert businesses to the danger of
relying on any single technique for maintaining password security.

19-01-2026 A. ANANDITA IYER 86

 DEFENSIVE CONTROLS AGAINST PASSWORD ATTACKS
Ethical hacking always ends with mitigation. A secure password-based system uses
layered defense, not just “strong passwords.”
A strong defense includes:
 MFA (multi-factor authentication)
 account lockout and throttling
 monitoring and alerting
 password hashing with salt using modern algorithms
 password reuse prevention (in enterprise systems)
 secure password reset workflows
 disabling default credentials
 least privilege access control
Modern organizations also adopt passwordless technologies such as FIDO2 and passkeys
19-01-2026 A. ANANDITA IYER 87
to reduce dependency on passwords altogether.
 PASSWORD STORAGE AND THE ROLE OF HASHING
The strongest password can still be compromised if stored incorrectly.
Understanding hashing vs encryption is essential.
Hashing vs Encryption
Hashing is one-way. Encryption is reversible. Passwords should be hashed,
not encrypted. If passwords are encrypted, attackers may steal encryption
keys and recover all passwords.
Salting
A salt is random data added to a password before hashing. Salts prevent
attackers from using precomputed hash tables and ensure that two users
with the same password do not have the same hash.
19-01-2026 A. ANANDITA IYER 88