Unit 3: Scanning and Enumeration

Comprehensive Exam Notes (Deep-Dive Edition)

Syllabus Covered: Network penetration testing, Password cracking techniques and

countermeasures, Metasploit, Wireshark, NetBIOS tools.

1. Scanning vs. Enumeration

While reconnaissance (Unit 2) involves gathering preliminary data, Scanning and

Enumeration are where the attacker actively engages with the target to extract actionable
intelligence.

• Scanning: Identifying live hosts, open ports, and running services (e.g., using Nmap to
find that Port 445 is open).
• Enumeration: The process of extracting specific, detailed information from those open
services. This involves creating active connections to the target to list user accounts,
machine names, network shares, routing tables, and system configurations.

2. NetBIOS Enumeration

NetBIOS (Network Basic Input/Output System) is a Windows protocol that allows

applications on separate computers to communicate over a LAN. It typically runs over TCP/
IP via ports 137, 138, and 139.

A. What can be extracted?

If NetBIOS is exposed, an attacker can enumerate:

• List of computers belonging to a domain.

• List of open file and printer shares.
• Active user accounts and groups.
• Security policies and passwords.

1
B. NetBIOS Tools

• nbtstat: A native Windows command-line utility used to display NetBIOS over TCP/IP
(NetBT) protocol statistics and name resolution. (Command: nbtstat -A [IP
Address])
• Enum4linux: A powerful Kali Linux tool used to extract information from Windows
and Samba systems (enumerates shares, users, and OS details).

3. Password Cracking Techniques

Once a hacker has enumerated user accounts, the next logical step is to crack their
passwords to gain access. Passwords are rarely stored in plaintext; they are stored as
cryptographic hashes.

A. Types of Password Attacks

• Dictionary Attack: Uses a pre-compiled list of common words and passwords (like
"[Link]"). The cracking software hashes every word in the dictionary and
compares it to the stolen hash. Fast, but fails against complex passwords.
• Brute-Force Attack: Tries every single possible combination of characters (e.g., aaaaaa,
aaaaab). Guaranteed to work eventually, but takes an enormous amount of time for long
passwords.
• Rainbow Table Attack: Uses massive, pre-computed tables of hashes. Extremely fast for
cracking, but requires huge storage space. (Rendered useless if the password is "salted").

B. Password Cracking Tools

• John the Ripper: A fast, offline password cracker that automatically detects hash types
and excels at dictionary and rule-based attacks.
• Hashcat: Often known as the world's fastest password cracker because it heavily
utilizes GPU (Graphics Card) processing power to perform brute-force attacks.

C. Countermeasures

To defend against password cracking, organizations must implement:

• Salting: Adding random data (a "salt") to a password before hashing it. This completely
defeats Rainbow Table attacks.
• Strong Hashing Algorithms: Using slow, resource-intensive algorithms like Bcrypt,
PBKDF2, or Argon2 instead of fast algorithms like MD5 or SHA1.
• Account Lockout Policies: Locking an account after 3-5 failed login attempts prevents
online brute-forcing.

2
4. The Metasploit Framework

Metasploit is the world's most used penetration testing framework. It provides a

standardized way to develop, test, and execute exploits against remote targets.

A. Core Components of Metasploit

• Exploit: The piece of code that takes advantage of a vulnerability to breach the system
(e.g., EternalBlue).
• Payload: The code that runs after the exploit succeeds. The most famous payload is
Meterpreter, which gives the hacker an advanced, interactive shell on the victim's
machine.
• Auxiliary Modules: Scanners and enumerators that do not grant a shell (e.g., port
scanners, fuzzers, login brute-forcers).

5. Advanced Wireshark Usage (Sniffing)

While introduced in Unit 2, Wireshark is vital in Unit 3 for Network Penetration Testing
through packet sniffing.

• Sniffing Plaintext Credentials: Many legacy protocols (HTTP, FTP, Telnet) transmit data
in plaintext. An attacker on the same network can use Wireshark to capture packets and
read usernames and passwords directly.
• Key Filters:
◦ [Link] == "POST" : Filters for data being submitted to web
servers (often logins).
◦ [Link] == [Link] : Isolates traffic to or from a specific victim machine.

3
📝 Exam Preparation Section

Short Answer Questions (2-3 Marks)

1. Differentiate between Scanning and Enumeration.

Ans: Scanning simply identifies which hosts are live and which ports are open.
Enumeration is a deeper, more aggressive process that connects to those open ports to
extract specific data like usernames, file shares, and system names.

2. What is an exploit in the context of the Metasploit Framework?

Ans: An exploit is a specific module or script that takes advantage of a software
vulnerability to gain unauthorized access to a target system.

3. How does "Salting" protect passwords?

Ans: Salting appends a unique, random string of characters to a password before it is
hashed. This ensures that even if two users have the same password, their hashes will
look completely different, effectively neutralizing Rainbow Table attacks.

Long Answer Questions (5-10 Marks)

1. Explain the three primary methods of password cracking (Dictionary, Brute-

Force, and Rainbow Tables). Provide one countermeasure to defend against them.
Hint: Define Dictionary (using a list of common words), Brute-Force (trying every
character combination), and Rainbow Tables (using pre-computed hash databases). For
countermeasures, discuss implementing strong password complexity rules (defeats
dictionary/brute-force) and utilizing "Salts" alongside slow hashing algorithms like
Bcrypt (defeats Rainbow Tables and slows down Brute-Force).

2. Discuss the architecture of the Metasploit Framework, specifically detailing the

difference between an Exploit, a Payload, and an Auxiliary module.
Hint: Describe Metasploit as an all-in-one penetration testing platform. Break down the
components: the Exploit is the "battering ram" that breaks through the vulnerability.
The Payload is the "soldier" (malicious code/Meterpreter shell) that runs inside the
system once the door is broken. Auxiliary modules are tools used for scanning, sniffing,
or fuzzing without explicitly requiring a payload.

Multiple Choice Questions (MCQs)

Q1. Which of the following tools is primarily used to enumerate NetBIOS

information from a Windows machine using Linux?
a) Wireshark b) Enum4linux c) Hashcat d) John the Ripper

4
Q2. In Metasploit, what is "Meterpreter"?
a) An exploit module b) An auxiliary scanner c) An advanced, interactive payload
d) A vulnerability database

⚡ Quick Revision Cheat Sheet

• Scanning: "Are you there? Are your doors open?" (Uses Nmap).
• Enumeration: "What are the names of the people inside? What files do you have?"
(Uses Enum4linux, nbtstat).
• NetBIOS: Windows protocol (Ports 137-139). Leaks usernames and shares if left
unprotected.
• Dictionary Attack: Trying thousands of known passwords from a text file (fast).
• Brute-Force: Trying every mathematical combination of letters/numbers (slow).
• Salting: Adding random data to passwords before hashing to stop Rainbow Tables.
• John the Ripper & Hashcat: The two most famous password cracking tools.
• Metasploit Framework:
◦ Exploit: The vehicle that delivers the attack.
◦ Payload: The bomb (malicious code) dropped by the vehicle.

• Wireshark in PT: Sniffing the network to capture plaintext HTTP/FTP passwords in

real-time.