MODULE 4

ENUMERATION AND EXPLOITATION

EXAM-READY NOTES ● 16-MARK FORMAT

Ethical Hacking | Semester Exam

Every topic is written as a complete 16-mark answer with definitions, tables, flowcharts, and exam tips.
 1. Enumeration Techniques

Enumeration is the process of systematically extracting detailed

Definition information about a target system, network, and infrastructure to
identify potential entry points for exploitation.

What Is Enumeration? (Context)

Enumeration comes after scanning. Once you know a target is alive and which ports are open,
enumeration goes deeper — it finds out WHAT is running, WHO is using it, and HOW it is configured.
This phase gives attackers (and ethical hackers) the raw intelligence they need to plan an attack.

6 Types of Enumeration — with Tools

Type What It Finds Tools Used
Network Enumeration Active devices, open ports, Nmap, Netcat, Ping
running services
User Enumeration Valid usernames and group SMB queries, SSH probing
accounts on the system
Service Enumeration Type, version, and config of Netstat, Nessus
each service running
Application Outdated web apps, CMS Nikto, OWASP ZAP
Enumeration platforms, exposed APIs
DNS Enumeration Domain names, subdomains, IP Dig, DNSRecon
addresses, mail servers
SNMP Enumeration Device info via Simple Network SNMPwalk, SolarWinds
Management Protocol

Enumeration vs Scanning — Key Difference

Scanning Enumeration
Finds WHAT is open Finds WHO and WHAT is behind those open ports
(ports/hosts)
Surface-level information Deep, detailed information
Example: Port 22 is open Example: OpenSSH 7.4 is running with root login enabled
Tool: Nmap (basic) Tool: Nmap (scripts), SNMPwalk, Dig

Flowchart: How Enumeration Works

STEP 1: Start with a known target (IP / domain from scanning phase)
 ▼
STEP 2: Run Network Enumeration — find active hosts and open ports

▼
STEP 3: Run Service Enumeration — identify service name, version, config

▼
STEP 4: Run User Enumeration — discover accounts and groups (SMB, SSH)

▼
STEP 5: Run DNS Enumeration — map subdomains and IP addresses

▼
STEP 6: Run SNMP / Application Enumeration — find device info and app
weaknesses

▼
STEP 7: Compile all data → Build target profile → Move to Exploitation

📝 EXAM TIP: All 6 types (Network, User, Service, Application, DNS, SNMP) with tools must
be written. Draw the flowchart for extra marks. The Enumeration vs Scanning comparison
table is a common bonus question.
 2. Soft Objectives

Soft objectives are information-gathering goals that aim to collect

Definition maximum useful data from a target WITHOUT triggering alerts,
causing disruption, or revealing the tester's presence.

Why Soft Objectives Matter

In penetration testing, being detected is a failure. Soft objectives are all about gathering intelligence
quietly and carefully. Think of it like reconnaissance in a military operation — you want to know
everything before you strike, without letting the enemy know you're watching.

Three Key Soft Objectives

Soft Objective What It Means in Simple Terms
Identifying Vulnerabilities Quietly find weak points — misconfigurations, unpatched
software, weak passwords — without triggering IDS/IPS
alarms
Avoiding Detection Use slow scans, encrypted traffic, and careful techniques so
security tools don't flag the activity
Building a Profile Construct a complete picture of the target: network topology,
user hierarchy, services, dependencies — a 'blueprint' of the
target

How Soft Objectives Connect to the Bigger Picture

Soft objectives feed directly into the attack strategy. The more silently and completely you can gather
information, the more targeted, realistic, and successful the exploitation phase becomes.

Soft Objectives vs Hard Objectives

Soft Objectives Hard Objectives
Stealth-focused — avoid Result-focused — achieve a specific goal (e.g., gain root
detection access)
Intelligence gathering Exploitation phase
phase
Example: Map network Example: Exploit a known CVE to get shell access
topology silently
Tools used slowly and Tools used aggressively to achieve the goal
carefully
📝 EXAM TIP: 3 soft objectives (Vulnerability ID, Avoid Detection, Build Profile) with simple
explanations score well. Add the Soft vs Hard comparison table for full 16 marks.
 3. Looking Around or Attack

'Looking Around' is the exploration phase where testers examine

Definition gathered enumeration data to identify potential attack vectors, decide
which vulnerabilities to exploit, and plan the actual attack.

What Does 'Looking Around' Mean?

After collecting all enumeration data, the tester doesn't just jump into exploiting. They step back and
analyze the information — like studying a map before entering unknown territory. This phase bridges
enumeration and exploitation.

Three Core Exploration Steps

Step What to Do & Why
Review Open Ports & SSH on port 22 → possible brute force target. HTTP on 80 →
Services look for web vulnerabilities. Each open port tells a story.
Analyze User Accounts Find accounts with weak passwords, inactive accounts, or
admin-level privileges that can be exploited for unauthorized
access.
Map the Network Understand how the network is segmented, how traffic flows,
and which nodes are vulnerable — helps identify the shortest
path to high-value targets.

Decision Flow: Look Around → Choose Attack Vector

STEP 1: Collect all enumeration results (ports, users, services, OS, DNS)

▼
STEP 2: Review open ports — assign possible attack type to each (SSH → brute
force, HTTP → SQLi / XSS)

▼
STEP 3: Analyze user accounts — identify weak credentials or admin accounts

▼
STEP 4: Map the network — find segmentation gaps and vulnerable nodes

▼
STEP 5: Rank attack vectors by impact and ease of exploitation

▼
STEP 6: Select the best attack path → proceed to Exploitation Phase
Common Attack Vectors Identified During 'Looking Around'
Port / Service Found Likely Attack Vector
SSH (Port 22) Brute force attack using weak passwords
HTTP/HTTPS (80/443) SQL Injection, XSS, Directory Traversal
FTP (Port 21) Anonymous login, unencrypted credential theft
SMB (Port 445) EternalBlue exploit, pass-the-hash attack
RDP (Port 3389) Brute force, BlueKeep vulnerability
SNMP (Port 161) Community string extraction, device takeover

📝 EXAM TIP: Write all 3 exploration steps clearly. The port-to-attack-vector table is a very
high-scoring addition — examiners love specific examples like SSH → brute force.
 4. Elements of Enumeration

Elements of enumeration are the specific categories of information that

Definition are systematically extracted from a target during the enumeration
phase, forming the foundation for exploitation planning.

Why Study the Elements?

Enumeration isn't a single action — it's a structured process with multiple components. Each element
targets a different layer of the system. Understanding all elements ensures no critical attack surface
is missed.

Four Core Elements of Enumeration

Element What Is Extracted & Why It Matters
Host Identification Find all active hosts using Ping sweeps and ARP scans.
Knowing which machines are live tells you where to focus.
Service Detection Identify service names, versions, and configurations.
Outdated versions = known CVEs that can be exploited
directly.
Credential Discovery Extract usernames, passwords, and password hashes.
Cracked credentials = direct access without breaking
anything.
File & Directory Locate publicly accessible files, directories, backup files, and
Enumeration admin panels on web servers. Often exposes sensitive config
files.

Tools Used for Each Element

Element Common Tools
Host Identification Ping, Nmap (-sn), ARP-scan, Netdiscover
Service Detection Nmap (-sV), Nessus, Netstat, Masscan
Credential Discovery Metasploit (smb_enumusers), Enum4linux, Hydra
File & Directory DirBuster, Gobuster, Nikto, Burp Suite
Enumeration

How Elements Build on Each Other

STEP 1: Host Identification — Know which machines are online

▼
 STEP 2: Service Detection — Know what is running on those machines

▼
STEP 3: Credential Discovery — Find who can log in and with what

▼
STEP 4: File & Directory Enumeration — Find what is exposed on those services

📝 EXAM TIP: 4 elements with tools = guaranteed good marks. Draw the mini flowchart
showing how elements build on each other. Credential Discovery is the most exam-favourite
element.
 5. Preparing for the Next Phase

Preparing for the next phase means taking all enumeration findings
Definition and converting them into an organized, prioritized exploitation plan —
selecting targets, tools, and methods before any active attack begins.

Why This Phase Exists

Jumping straight into exploitation without preparation leads to noisy, unorganized attacks that get
detected and fail. This preparation phase is like writing a battle plan — you know the target, the
weapon, and the strategy before you strike.

4 Key Preparations
Preparation Step Details
Prioritize Targets Not all vulnerabilities are equal. Focus on high-risk, high-
impact weaknesses first — those that give the most access
with the least detection risk.
Tool Selection Match the right tool to the right vulnerability. Don't use a
hammer when you need a scalpel. Example: Use SQLmap
for SQL injection, Metasploit for known CVEs.
Exploit Development For unique or custom vulnerabilities, write or customize
scripts. This could mean modifying a public exploit to fit the
specific version or configuration found.
Establish Persistence Plan ahead — how will you maintain access after
exploitation? Think backdoors, scheduled tasks, or
Meterpreter sessions before you even gain access.

Preparation Flowchart

STEP 1: Review all enumeration results — list every vulnerability found

▼
STEP 2: Prioritize targets — rank by risk level (critical → high → medium → low)

▼
STEP 3: Select appropriate tools for each vulnerability

▼
STEP 4: Customize or develop exploits for unique vulnerabilities

▼
STEP 5: Plan persistence mechanism — how to maintain access after exploitation
 ▼
STEP 6: Launch the attack (Exploitation Phase)

Prioritization Framework
Priority Level When to Use
Critical Direct path to root/admin access, no authentication required
High Requires one step but leads to significant data or access
Medium Useful but needs additional chaining with other vulnerabilities
Low Informational value only, minimal direct exploitation impact

📝 EXAM TIP: All 4 steps (Prioritize, Tool Selection, Exploit Development, Persistence)
must be covered. The prioritization table (Critical/High/Medium/Low) is a great bonus for full
marks.
 6. Intuitive Testing

Intuitive testing is a flexible, experience-driven approach to uncovering

hidden vulnerabilities by forming hypotheses, observing system
Definition
behaviour, and adapting techniques based on what the system
reveals.

What Makes Intuitive Testing Different?

Standard enumeration follows a checklist. Intuitive testing goes beyond the checklist — it uses the
tester's experience and creativity to find things that automated tools miss. It is the 'detective work' of
ethical hacking.

Two Core Methods of Intuitive Testing

Method Explanation with Example
Hypothesis Testing The tester forms a 'guess' based on what they observe, then
tests it. Example: The server has an outdated SSL certificate
→ Hypothesis: weak encryption may be in use → Test: Try
SSLv3 or TLS 1.0 downgrade attacks.
Adaptive Strategies The tester adjusts their approach based on how the target
responds. Example: If direct scanning triggers an IDS alert,
switch to slower, fragmented scans or use decoys.

When Is Intuitive Testing Used?

Intuitive testing is applied when:
➤ Automated tools fail to find vulnerabilities but something feels 'off' about the system
➤ The system behaves unexpectedly — error messages reveal internal info
➤ Time allows for deeper manual investigation beyond standard scans
➤ The tester has prior experience with similar systems or technologies

Intuitive Testing vs Automated Testing

Intuitive Testing Automated Testing
Experience and creativity- Rule and signature-driven
driven
Finds zero-day or logic- Finds known, catalogued vulnerabilities
based vulnerabilities
Slower but more thorough Faster but may miss custom or unusual weaknesses
Example: Spotting a Example: Nessus detecting an unpatched Apache version
business logic flaw in a
form
📝 EXAM TIP: Definition + 2 methods (Hypothesis Testing & Adaptive Strategies) + Intuitive
vs Automated comparison table = strong 16-mark answer. Mention that intuitive testing finds
what tools miss.
 7. Evasion

Evasion techniques are methods used by attackers (and ethical

Definition hackers) to bypass security detection mechanisms — such as IDS,
IPS, firewalls, and antivirus — during enumeration and exploitation.

Why Evasion Is Necessary

Modern networks are protected by Intrusion Detection Systems (IDS), Intrusion Prevention Systems
(IPS), firewalls, and antivirus software. Without evasion techniques, any scan or attack will be
immediately flagged, blocked, and traced back to the attacker.

4 Common Evasion Techniques

Evasion Technique How It Works & Why It Is Effective
Traffic Obfuscation Encrypts or disguises data so IDS cannot read its content.
Tools like Ncat with SSL tunnelling send data that looks like
normal HTTPS traffic to security systems.
Slow and Steady Scans Sends scan packets very slowly (minutes apart instead of
milliseconds). Rate-based IDS alerts are triggered by HIGH
speed — slow scans slip under the radar.
Payload Encryption Encodes malicious payloads so antivirus cannot match them
against known signatures. Metasploit's 'msfvenom' with
encoders like shikata_ga_nai does exactly this.
IP Spoofing Fakes the source IP address in packets so detection systems
log the wrong attacker. Combined with decoy scans in Nmap
(-D flag), this hides the real source IP.

Evasion Against Specific Security Controls

Security Control Evasion Technique Used
Intrusion Detection System Slow scans, traffic fragmentation, traffic obfuscation
(IDS)
Antivirus (AV) Software Payload encoding, polymorphic payloads, fileless attacks
Firewall Port knocking, tunnelling over allowed ports (HTTP/HTTPS)
IPS (Intrusion Prevention IP spoofing, decoy scanning, protocol manipulation
System)

Evasion Flowchart

STEP 1: Identify what security controls are protecting the target (IDS, AV, Firewall)
 ▼
STEP 2: Select appropriate evasion technique for each control

▼
STEP 3: Apply Traffic Obfuscation to bypass IDS content inspection

▼
STEP 4: Use Slow Scans to avoid rate-based detection

▼
STEP 5: Encrypt / Encode payloads to bypass Antivirus

▼
STEP 6: Use IP Spoofing / Decoys to hide true identity

▼
STEP 7: Proceed with enumeration or exploitation undetected

📝 EXAM TIP: All 4 techniques (Obfuscation, Slow Scans, Payload Encryption, IP Spoofing)
must be in your answer. The 'Evasion vs Security Control' table is a high-mark addition.
 8. Threads and Groups

In enumeration, 'threads and groups' refers to the process of

identifying active system processes (threads) and user permission
Definition
groups to understand who has elevated access and what critical
operations are running.

Why Threads and Groups Matter

Groups tell you WHO has power on the system — administrators, backup operators, remote desktop
users. Threads tell you WHAT is running on the system — active processes, services, and their
dependencies. Together, they reveal the highest-value targets for privilege escalation.

User Groups — Key Focus Areas

Group Type Why It Is a Target
Administrator Group Full system control — compromising any member gives
complete access
Backup Operators Can access and read all files even if not administrators —
data theft risk
Remote Desktop Users Can log in remotely — potential for persistent remote access
Domain Admins (in AD) Control the entire Active Directory domain — highest value
target in Windows environments
Sudoers Group (Linux) Members can run commands as root — escalation path on
Linux systems

Threads (Active Processes) — What to Look For

Thread / Process Security Relevance
Antivirus Process If AV is running, payloads must be encoded to avoid
detection
Backup Service Threads Access to backup files = access to potentially unencrypted
sensitive data
Database Service (SQL) Database process running = SQL injection or credential theft
possible
Admin Remote Access Remote management processes = potential backdoor entry
Tool point

Tools for Enumerating Groups and Threads

➤ Windows: net localgroup administrators — lists all members of admin group
➤ Windows: tasklist — shows all running processes (threads)
➤ Linux: cat /etc/group — shows all groups and members
➤ Linux: ps aux — shows all running processes
➤ Enum4linux — automates Windows user and group enumeration over SMB

📝 EXAM TIP: Groups (focus on Admin, Domain Admins, Sudoers) + Threads (AV, DB,
Backup processes) + Tools are the 3 parts of a full answer. Mention privilege escalation as
the end goal.
 9. Operating Systems

Operating System (OS) enumeration is the process of identifying the

Definition exact OS version, installed patches, and default configurations of a
target system to find OS-specific vulnerabilities that can be exploited.

Why OS Enumeration Is Critical

Every operating system has its own set of known vulnerabilities (CVEs). Knowing the exact OS
version — Windows Server 2012, Ubuntu 18.04, CentOS 7 — tells the attacker exactly which exploits
apply. Missing a patch means an unprotected CVE is sitting on that system waiting to be used.

3 Key Details to Gather in OS Enumeration

Information to Find How It Is Used in Attacks
OS Version Maps directly to known CVEs. Example: Windows 7 →
MS17-010 (EternalBlue). Windows Server 2012 → Multiple
unpatched RCE vulnerabilities.
Installed Patches Missing patches = open vulnerabilities. Check update history
to find what has NOT been patched and search for
corresponding exploits.
Default Configurations Many systems ship with weak defaults — default admin
credentials, open services, unnecessary features enabled.
These are easy wins for attackers.

OS Fingerprinting Methods
Method How It Works
Active Fingerprinting Sends crafted packets to the target and analyses the
response (TTL values, TCP flags). Nmap -O performs active
OS detection.
Passive Fingerprinting Observes existing network traffic without sending any
packets — completely silent. Tool: p0f.
Banner Grabbing Connects to a service and reads the banner it sends back.
Example: 'Apache/2.4.29 (Ubuntu)' reveals OS and service
version instantly.

OS Enumeration Tools
➤ Nmap -O : Active OS fingerprinting from port scan results
➤ Nmap -sV : Service version detection (reveals OS through service banners)
➤ p0f : Passive OS fingerprinting — completely silent
➤ Netcat : Manual banner grabbing from services
➤ Metasploit smb_version module : OS version via SMB protocol (Windows)

📝 EXAM TIP: 3 key details (OS Version, Patches, Default Config) + 3 fingerprinting
methods (Active, Passive, Banner Grabbing) + tools = complete 16-mark answer. Give a
real CVE example like EternalBlue.
 10. Password Crackers

Password cracking is the process of recovering plain-text passwords

Definition from stored hashes or intercepted credentials using computational
techniques — to test password strength and gain unauthorized access.

How Password Cracking Works

Systems never store plain-text passwords — they store a 'hash' (a scrambled version). Password
cracking takes that hash and tries to find the original password. Think of it like being given a
fingerprint and trying to find the person it belongs to.

4 Password Cracking Techniques

Technique How It Works & When to Use It
Brute Force Attack Tries every possible combination of characters (aaa, aab,
aac...). Guaranteed to crack but extremely slow. Use only on
short passwords.
Dictionary Attack Uses a pre-compiled wordlist of common passwords (e.g.,
[Link] with 14 million entries). Fast and effective
against weak passwords.
Rainbow Table Attack Uses a pre-computed database of hash-to-password
mappings. Extremely fast — no computation needed at
attack time. Stopped by 'salting' hashes.
Hybrid Attack Combines dictionary words with number/symbol variations
(e.g., password1, P@ssword). Effective against passwords
people think are 'clever'.

Key Password Cracking Tools

Tool What It Does
John the Ripper Versatile hash cracker — supports MD5, SHA1, bcrypt, and
more. Can auto-detect hash type and apply dictionary or
brute force.
Hashcat GPU-accelerated cracker — extremely fast, especially with
rainbow tables and large wordlists. Best for cracking at scale.
Hydra Online brute-force tool — attacks live services over SSH,
FTP, HTTP login forms, RDP. Tries credentials in real time.
Medusa Similar to Hydra but faster for parallel multi-protocol brute
force attacks.
Password Attack Flowchart

STEP 1: Obtain password hashes (from database dump, SAM file, /etc/shadow, or
network capture)

▼
STEP 2: Identify hash type (MD5, SHA1, NTLM, bcrypt) using hash-identifier or
Hashcat

▼
STEP 3: Try Dictionary Attack first (fastest — [Link] wordlist)

▼
STEP 4: If failed → Try Hybrid Attack (wordlist + variations)

▼
STEP 5: If failed → Try Rainbow Tables (if hash is unsalted)

▼
STEP 6: If failed → Use Brute Force (last resort — slow but guaranteed for short
passwords)

▼
STEP 7: Recovered password → Use for direct login or lateral movement

📝 EXAM TIP: 4 techniques + 4 tools + the cracking flowchart = full marks. Mention that
Rainbow Tables fail against SALTED hashes — that's the defence, which examiners love to
see.
 11. RootKits

A rootkit is a type of stealthy malware that gains and maintains

administrative (root/admin) level access to a system while actively
Definition
hiding its presence from the operating system, antivirus, and the
system owner.

Why Rootkits Are Dangerous

A normal virus does damage and gets caught. A rootkit does damage AND hides itself. Even after a
user or admin thinks they've cleaned the system, the rootkit can still be active — hiding processes,
hiding files, and maintaining the attacker's access invisibly.

Types of Rootkits
Rootkit Type How It Works
User-Mode Rootkit Runs in user space. Intercepts system calls to hide files and
processes. Easier to detect and remove.
Kernel-Mode Rootkit Runs inside the OS kernel — the deepest level of the system.
Extremely difficult to detect because it controls the OS itself.
Bootloader Rootkit Infects the Master Boot Record (MBR). Loads before the OS
— persists even after OS reinstall.
Hypervisor Rootkit Sits below the OS and controls it as a virtual machine. Almost
impossible to detect from within the OS.
Firmware Rootkit Embeds in hardware firmware (BIOS/UEFI). Survives full disk
wipes and OS reinstalls. Rare but devastating.

Purpose and Goals of a Rootkit

➤ Maintain long-term, hidden access to the compromised system
➤ Hide malicious files, processes, and network connections from the OS
➤ Intercept and steal keystrokes, passwords, and session tokens
➤ Provide a backdoor for the attacker to return at any time
➤ Evade antivirus and endpoint detection tools

Rootkit Detection Tools

Tool What It Does
Chkrootkit Scans Linux systems for known rootkit signatures and
suspicious binaries
Rootkit Hunter (rkhunter) Checks file permissions, hidden files, suspicious processes,
and system binary integrity on Linux
GMER Windows-based rootkit scanner — detects hidden processes,
drivers, and registry entries
Malwarebytes General malware scanner with rootkit detection module

📝 EXAM TIP: Definition + 5 types of rootkits + purpose + detection tools = complete 16-
mark answer. Kernel-Mode and Bootloader rootkits are the most commonly asked types.
Mention 'hiding from OS' as the key characteristic.
 12. Applications

Application enumeration and exploitation involves analysing software

applications running on the target system for security weaknesses
Definition
caused by poor coding practices, outdated versions, or insecure
configurations.

Why Applications Are a Major Attack Surface

Applications sit between the user and the data. They take user input, process it, and interact with
databases and servers. Poor input validation = attackers can manipulate those interactions. Most
real-world breaches happen through application-layer vulnerabilities, not network vulnerabilities.

Web Application Vulnerabilities

Vulnerability What It Is & How It Is Exploited
SQL Injection (SQLi) Attacker inserts malicious SQL code into input fields (login
forms, search boxes) to manipulate the database. Can
extract all data, bypass logins, or delete records.
Cross-Site Scripting (XSS) Attacker injects malicious JavaScript into a web page. When
another user views the page, the script runs in THEIR
browser — can steal cookies, session tokens.
Directory Traversal Attacker navigates outside the web root directory using '../'
sequences to access system files like /etc/passwd.
Broken Authentication Weak session management, no account lockout, or
predictable tokens allow attackers to hijack sessions or brute
force logins.
Insecure Direct Object Ref. Changing a parameter (e.g., ?user_id=123 → ?user_id=124)
lets attackers access other users' data without authorisation.

Legacy Software Issues

➤ Unsupported software no longer receives security patches — known CVEs remain permanently
open
➤ Old CMS platforms (WordPress plugins, Joomla modules) have publicly listed vulnerabilities
➤ Legacy software often has hardcoded credentials or weak default settings
➤ No vendor support means no fixes — organisations must upgrade or isolate

Application Enumeration Tools

Tool Purpose
Nikto Web server scanner — detects dangerous files, outdated
software, misconfigurations
Burp Suite Web application testing proxy — intercepts, modifies, and
replays HTTP requests
OWASP ZAP Free open-source web app scanner — finds XSS, SQLi, and
other OWASP Top 10 vulnerabilities
SQLmap Automates SQL injection detection and exploitation
WPScan WordPress-specific scanner — finds vulnerable plugins,
themes, and user accounts

📝 EXAM TIP: Web vulnerabilities (SQLi, XSS, Directory Traversal) + Legacy Software
issues + Application tools = full answer. SQLi and XSS are the most-asked vulnerabilities —
know both in detail.
 13. Wardialing

Wardialing is a technique that involves automatically dialling large

ranges of phone numbers to discover modems, fax machines, or other
Definition
dial-up devices connected to a target network — which can be
exploited as alternative entry points.

Historical Context and Modern Relevance

Wardialing was originally made famous in the 1983 film 'WarGames.' In the early internet era,
organizations connected to networks via phone modems. Today, many industrial control systems,
SCADA networks, legacy banking systems, and remote monitoring devices still use modem
connections — making wardialing relevant for critical infrastructure testing.

How Wardialing Works

STEP 1: Define target phone number range (e.g., all numbers in a company's PBX
range)

▼
STEP 2: Automated tool dials each number in sequence

▼
STEP 3: Listens for modem carrier tones or fax handshake signals

▼
STEP 4: Logs all numbers that respond with a modem/fax tone

▼
STEP 5: Tester manually investigates each discovered modem connection

▼
STEP 6: Attempt to authenticate or exploit the connected device

▼
STEP 7: Use modem connection as entry point to the internal network

What Wardialing Discovers

Device Found Potential Security Risk
Modem connected to a Direct dial-in access to internal systems — bypasses all
server network security
Fax machine Fax-to-email systems can reveal sensitive documents
 Industrial/SCADA systems Control systems with modems may allow remote
manipulation of physical infrastructure
PBX phone systems VoIP and PBX systems may have default credentials that
allow internal network access

Wardialing Tools
➤ WarVOX — Modern open-source wardialing tool, analyses audio fingerprints of connections
➤ ToneLoc — Classic wardialing tool for legacy phone systems
➤ THC-SCAN — Windows-based wardialer for modem hunting

Why Wardialing Is Important in Pen Testing

Modems are 'side doors' into an organization — they completely bypass firewalls, VPNs, and network
monitoring because they connect through the phone network, not the internet. A modem discovered
by wardialing can give an attacker direct dial-up access to the internal network as if they were
physically inside the building.

📝 EXAM TIP: Definition + how wardialing works flowchart + what it discovers (modems
bypass firewalls) + tools = complete answer. Always emphasize that modems BYPASS
network security controls.
 14. Network, Services, and Areas of Concern

Network and service enumeration focuses on mapping the structure of

the target network, identifying all running services, and highlighting
Definition
critical areas — such as misconfigurations and unencrypted traffic —
that represent the highest security risk.

Network Enumeration
Network enumeration means building a complete map of the target's network — like drawing a
blueprint of a building before deciding where to break in. You need to know what's connected, how
it's connected, and what's protecting it.

Network Enumeration Techniques

Technique What It Reveals
Ping Sweeps Identifies all live hosts within a subnet — tells you how many
machines are active
Traceroute / Tracert Maps the route packets take through the network — reveals
routers, gateways, and network hops
ARP Scanning Discovers hosts on the local network segment using ARP
requests — even finds hosts blocking ICMP pings
SNMP Walking Queries network devices (routers, switches) for their routing
tables, interface lists, and connected devices
NetBIOS/SMB Scanning Maps Windows network shares, domain structure, and
connected computers in a Windows environment

Service Analysis — Vulnerable Services to Focus On

Service Common Vulnerabilities to Check
FTP (Port 21) Anonymous login enabled? Unencrypted credentials?
Writable directories?
HTTP (Port 80) Directory listing enabled? Default pages? SQLi / XSS
vulnerable forms?
RDP (Port 3389) Weak passwords? NLA disabled? BlueKeep (CVE-2019-
0708) unpatched?
SMTP (Port 25) Open relay configured? Allows spam sending and email
spoofing?
Telnet (Port 23) Completely unencrypted — credentials sent in plain text —
immediate concern
SNMP (Port 161) Default community strings 'public'/'private' still in use?
Areas of Concern — Critical Security Weaknesses
Area of Concern Why It Is Dangerous
Misconfigured Firewalls Overly permissive rules allow unauthorized traffic to pass.
Example: All traffic allowed from internal to DMZ defeats the
purpose of the DMZ.
Unencrypted Traffic Telnet, FTP, HTTP transmit data in plain text. A single
network capture (Wireshark) can reveal usernames,
passwords, and session tokens.
Open Network Shares Improperly secured file shares accessible to all users can
expose sensitive documents, configs, and backup files.
Default Credentials Routers, switches, and services left with factory default
usernames and passwords (admin/admin, admin/password).

Network Security Assessment Flowchart

STEP 1: Perform Ping Sweep — identify all live hosts in the network

▼
STEP 2: Run ARP Scan — catch hosts blocking ICMP

▼
STEP 3: Run Traceroute — map network topology and gateway structure

▼
STEP 4: Enumerate services on each live host (Nmap -sV)

▼
STEP 5: Check each service for known misconfigurations and CVEs

▼
STEP 6: Capture network traffic — identify unencrypted protocols in use

▼
STEP 7: Document all areas of concern — report with risk ratings

📝 EXAM TIP: 3 sections (Network Enumeration, Service Analysis, Areas of Concern) all
need coverage. The 'Unencrypted Traffic' point (Telnet, FTP, HTTP) is highly exam-
favourite. Always mention Misconfigured Firewalls and Default Credentials.
 QUICK REVISION SUMMARY — ALL TOPICS

TOPIC ONE-LINE EXAM DEFINITION

Enumeration Techniques Systematically extracting info about a target using Network, User,
Service, DNS, SNMP & Application enumeration
Soft Objectives Stealth information-gathering goals — Identify Vulnerabilities, Avoid
Detection, Build Target Profile
Looking Around or Attack Analysing enumeration data to identify attack vectors by reviewing
ports, users, and network maps
Elements of Enumeration Host Identification, Service Detection, Credential Discovery, File &
Directory Enumeration
Preparing for the Next Converting findings into an exploitation plan — Prioritize, Select Tools,
Phase Develop Exploits, Plan Persistence
Intuitive Testing Experience-driven vulnerability discovery using Hypothesis Testing and
Adaptive Strategies
Evasion Bypassing IDS/AV/Firewall using Traffic Obfuscation, Slow Scans,
Payload Encryption, and IP Spoofing
Threads and Groups Enumerating user permission groups and active processes to find
privilege escalation targets
Operating Systems OS fingerprinting to find OS version, missing patches, and default
configurations for known CVE exploitation
Password Crackers Recovering passwords from hashes using Brute Force, Dictionary,
Rainbow Tables, and Hybrid attacks
RootKits Stealthy malware maintaining hidden admin access — User-Mode,
Kernel-Mode, Bootloader, Hypervisor, Firmware types
Applications Exploiting web apps (SQLi, XSS, Directory Traversal) and legacy
software with unpatched vulnerabilities
Wardialing Auto-dialling phone ranges to find modems/fax devices that bypass
network firewalls as internal entry points
Network, Services, Areas Mapping network topology, analysing vulnerable services, and
of Concern identifying misconfigurations and unencrypted traffic

YOU'VE GOT THIS! GOOD LUCK IN YOUR EXAM!

Enumerate → Analyse → Evade → Exploit → Document