Assignment Enumeration
On Virtual box, Open
➢ Windows Sever 2008
➢ Windows Server 2012
➢ Sniffing Server
➢ Kali Linux
Make all of them “Host Only”
Task:
1) Scan this Network and find out the IP address of remaining Machines
2) Perform Enumeration for the following technologies and protocols
(NetBIOS, SNMP, LDAP, NFS, SMTP)
Task 1: Scanning the Network:
#ifconfig
#nmap -sP 192.168.103/24
Result displayed along with the IP addresses, Host status and Mac address
Task 2: Enumeration for the following technologies and
protocols (NetBIOS, SNMP, LDAP, NFS, SMTP):
NetBIOS Enumeration:
> nbtstat -c
The “nbtstat -c” command in Windows CMD is used to display the NetBIOS name
cache, which stores recently resolved NetBIOS names and their corresponding
IP addresses. NetBIOS (Network Basic Input/Output System) is a protocol used
for communication over a local network.
> net user
The “net user” command in Windows CMD is used to display information about
user accounts on a local or remote computer. When you run net user without
any additional parameters, it lists all user accounts on the computer you're
currently using.
# nmap -sV -v --script [Link] [Link]
This nmap command is used to scan the target IP address [Link] for
open ports and services, while also running the NetBIOS name services
enumeration script to gather additional information about any Windows systems
on the network.
# nmap -sU -p 137 --script [Link] [Link]
This nmap command is used to scan the target IP address [Link]
specifically for UDP traffic on port 137, aiming to identify NetBIOS name services
running on Windows systems on the network and gather information about
them.
SNMP Enumeration:
# nmap -sU -p 161 [Link]
This nmap command is used to scan the target IP address [Link]
specifically for UDP traffic on port 161, which is commonly associated with
SNMP. This scan can help identify systems running SNMP services and potentially
gather information about them for further enumeration or analysis.
# snmp-check [Link]
The command snmp-check [Link] is used to perform SNMP
enumeration on the target IP address [Link]. snmp-check is a tool
specifically designed for SNMP enumeration, which is the process of querying
SNMP-enabled devices for information such as system description, hardware
information, network configuration, and more.
# snmpwalk -v1 -c public [Link]
This command can provide a wealth of information about the target device's
configuration, including system information, network interfaces, installed
software, and more.
# snmpwalk -v2c -c public [Link]
This command is used to gather detailed information about a network device
(specified by the IP address "[Link]") using SNMP (Simple Network
Management Protocol). By running this command, you can retrieve various data
about the device's configuration, such as its system details, network settings, and
installed software. It's a way to learn more about the device for network
management or troubleshooting purposes.
# nmap -sU -p 161 --script=snmp-sysdescr [Link]
This nmap command is used to scan the target IP address [Link]
specifically for UDP traffic on port 161, which is commonly associated with
SNMP. Additionally, it runs a specific script (snmp-sysdescr) to retrieve system
description information from SNMP-enabled devices, providing insight into the
target device's configuration.
# nmap -sU -p 161 --script=snmp-processes [Link]
This nmap command is used to scan the target IP address [Link]
specifically for UDP traffic on port 161, which is commonly associated with
SNMP. Additionally, it runs a specific script (snmp-processes) to retrieve
information about the processes running on the target device via SNMP. This can
provide insight into the target device's activities and potentially identify any
suspicious or unauthorized processes.
# nmap -sU -p 161 --script=snmp-win32-software [Link]
This nmap command aims to collect details about the software installed on the
Windows system at the provided IP address using SNMP. It's useful for inventory
management, security assessments, and system auditing.
# nmap -sU -p 161 --script=snmp-interfaces [Link]
This nmap command is aimed at gathering details about the network interfaces
of the device located at the specified IP address using SNMP. This information
can be valuable for network management, troubleshooting, and security analysis
purposes.
LDAP Enumeration:
# nmap -sU -p 389 [Link]
This nmap command is used to check if the LDAP service is running on the
specified IP address. LDAP enumeration involves discovering LDAP services and
potentially extracting information from them, which can be useful for network
reconnaissance and security assessments.
# nmap -p 389 --script ldap-brute --script-args
[Link]=‘“cn=users,dc=CEH,dc=com’” [Link]
This nmap command is used to conduct a brute force attack against LDAP
authentication on the specified IP address, targeting the LDAP service running on port
389. The attack tries to guess usernames and passwords starting from the specified
LDAP base distinguished name. This command can be used for security testing
purposes to assess the strength of LDAP authentication mechanisms and identify
potential vulnerabilities.
# ldapsearch -h [Link] -x -s base namingcontexts
This command is used to connect to an LDAP server at the specified IP address using
simple authentication, and then it searches for information about the naming contexts
of the LDAP server. This can help identify the base DNs that can be used as starting
points for LDAP searches and queries.
# ldapsearch -h [Link] -x -b “DC=CEH,DC=com”
This command is used to connect to an LDAP server at the specified IP address using
simple authentication, and then it searches the LDAP directory starting from the base
DN "DC=CEH,DC=com". This search could retrieve various information stored in the
LDAP directory for the specified domain.
# ldapsearch -x -h [Link] -x -b “DC=CEH,DC=com”
command is used to connect to an LDAP server at the specified IP address using simple
authentication, and then it searches the LDAP directory starting from the base DN
"DC=CEH,DC=com". This search could retrieve various information stored in the LDAP
directory for the specified domain.
NFS Enumeration:
# nmap -p 2049 [Link]
This nmap command is used to check if the NFS service is running on the specified IP
address. NFS enumeration involves discovering NFS services and potentially extracting
information from them, which can be useful for network reconnaissance and security
assessments.
# nmap --script=broadcast-dns-service-discovery [Link]
This command is used to identify DNS services related to the domain
[Link] by sending DNS service discovery queries on the network. It can
help in discovering DNS servers, their configurations, and possibly other related
information.
# nmap -T4 -p 53 --script dns-brute [Link]
This command is used to conduct a DNS brute force attack against the domain
[Link] by attempting to guess subdomains or hostnames associated with it.
This type of attack can be used for reconnaissance purposes to identify potentially
vulnerable or misconfigured DNS entries.
# nmap --script dns-srv-enum --script-args “dns-srv-
[Link]=[Link]”
This command is used to identify DNS servers and services associated with the
domain "[Link]" by querying DNS records such as SRV (Service)
records. It can provide valuable information about the DNS infrastructure and
configurations related to the specified domain.
SMTP Enumeration:
# nmap -p 25 --script=smtp-enum-users [Link]
this Nmap command is used to identify valid email addresses associated with
the SMTP server running on the specified IP address. It can be useful for
reconnaissance purposes to understand the user accounts present on the SMTP
server, which could potentially be exploited for malicious purposes if not
properly secured.
# nmap -p 25 --script=smtp-open-relay [Link]
This nmap command helps identify if the SMTP server at the specified IP address
is an open relay, meaning it allows anyone to send emails through it without
requiring authentication. Identifying open relay SMTP servers is crucial for
ensuring proper email security and preventing abuse by spammers.
# nmap -p 25 --script=smtp-commands [Link]
This Nmap command helps in assessing the behaviour of the SMTP server at the
specified IP address by sending a series of SMTP commands and observing its
responses. It can be used for diagnostics, troubleshooting, and security
assessments to ensure proper SMTP functionality and identify any potential
issues or vulnerabilities.