Noob Hackers
06
Enumeration & Network Vulnerabilities
Topic 2: SMB / Windows Enumeration
Command: nmap -p 139,445 --script=smb-enum-shares,smb-enum-users,smb-os-discovery -oA smb_enum [Link]
WHAT IT DOES:
Uses Nmap NSE scripts to enumerate SMB shares, users, and server OS; does port probe and runs SMB-related NSE scripts.
FLAGS:
-p 139,445 — scan SMB ports (NetBIOS & SMB over TCP), --script <scriptlist> — run NSE scripts (can be comma-separated), smb-enum-
shares — lists shares, smb-enum-users — enumerate user accounts (where possible), smb-os-discovery — tries to detect OS/version, -
oA <basename> — output in all formats (xml, nmap, grepable).
SAMPLE OUTPUT:
PORT STATE SERVICE
139/tcp open netbios-ssn
445/tcp open microsoft-ds
| smb-enum-shares:
| SharedDocs: READ CYBER SECURITY CLASSES
| Backups: READ, WRITE Join: 9113948054
| smb-enum-users: By Noob Hackers
INDUSTRY USE:
Use when embedding SMB checks into larger network discovery — easier to centralize results and keep outputs for reporting.
Good for scheduled scans or baseline checks.
Noob Hackers
MODULE 4.2
APPLICATION/SERVICE
ENUMERATION: SNMP,
WEBAPPS
CYBER SECURITY CLASSES
Join: 9113948054
By Noob Hackers
Noob Hackers
07
Enumeration & Network Vulnerabilities
Topic 3 : Application/Service Enumeration: SNMP, Webapps
Command: snmpwalk -v2c -c public [Link]
WHAT IT DOES:
SNMP Enumeration Walks through the SNMP MIB (It’s basically a database (or dictionary) of all the “things” that can be monitored or
managed on a device using SNMP (Simple Network Management Protocol)) tree using community string public. Extracts system info,
network interfaces, running processes, even plaintext credentials from misconfigured devices.
FLAGS:
snmpwalk — SNMP query tool, -v2c — SNMP protocol version (v2c = common, supports bulk), -c public — community string (like a
password). Try public, private, manager, [Link] — target IP.
SAMPLE OUTPUT:
SNMPv2-MIB::sysDescr.0 = STRING: Cisco IOS Software 15.1
SNMPv2-MIB::sysContact.0 = STRING: admin@[Link]
SNMPv2-MIB::sysName.0 = STRING: switch01
CYBER SECURITY CLASSES
Join: 9113948054
By Noob Hackers
INDUSTRY USE:
Red team: device fingerprinting, find plaintext creds or backup IPs.
Network admins: inventory devices and verify configurations.
SOC: detect unauthorized SNMP exposure.
Noob Hackers
08
Enumeration & Network Vulnerabilities
Topic 3 : Application/Service Enumeration: SNMP, Webapps
Command: curl -I [Link]
WHAT IT DOES:
Web Header Enumeration Fetches only the HTTP headers (no body). Reveals server type, framework, and security headers. Quick way
to profile a web app.
FLAGS:
curl — command-line web client.
-I — fetch headers only (HEAD request).
SAMPLE OUTPUT:
HTTP/1.1 200 OK
Date: Wed, 29 Oct 2025 [Link] GMT
Server: Apache/2.4.18 (Ubuntu)
X-Powered-By: PHP/7.0.33
Set-Cookie: sessionid=abc123 CYBER SECURITY CLASSES
Join: 9113948054
By Noob Hackers
INDUSTRY USE:
Web pentesting: identify tech stack (PHP, [Link], etc.).
Blue team: check for missing security headers (CSP, HSTS).
Bug bounty: early fingerprint before scanning.
Noob Hackers
09
Enumeration & Network Vulnerabilities
Topic 3 : Application/Service Enumeration: SNMP, Webapps
Command: nikto -h [Link]
WHAT IT DOES:
Web Vulnerability Scan Performs automated vulnerability scan of webserver — checks for outdated software, default files, insecure
headers, known exploits.
FLAGS:
-h — target host, -p — specify ports, -output [Link] — save output, -C all — check all potential config issues.
SAMPLE OUTPUT:
+ Server: Apache/2.4.18 (Ubuntu)
+ Retrieved x-powered-by header: PHP/7.0.33
+ The anti-clickjacking X-Frame-Options header is not present.
+ /phpmyadmin/: phpMyAdmin directory found
+ /[Link]: Potentially sensitive backup file found. CYBER SECURITY CLASSES
Join: 9113948054
By Noob Hackers
INDUSTRY USE:
Red team / bounty: fast surface-level vuln discovery.
Blue team: verify hardening baseline.
Auditors: compliance scans.
Noob Hackers
10
Enumeration & Network Vulnerabilities
Topic 3 : Application/Service Enumeration: SNMP, Webapps
Command: gobuster dir -u [Link] -w [Link]
WHAT IT DOES:
Directory Brute Force Brute-forces web directories using a wordlist. Helps find hidden admin panels, uploads, config files, etc.
FLAGS:
dir — directory brute mode, -u — target URL, -w — path to wordlist.
SAMPLE OUTPUT:
/admin (Status: 301)
/[Link] (Status: 200)
/uploads (Status: 403)
/[Link] (Status: 200)
CYBER SECURITY CLASSES
Join: 9113948054
By Noob Hackers
INDUSTRY USE:
Red team: find forgotten dev directories, backups, APIs.
Websec engineers: verify proper access controls.
Bug bounty: locate juicy endpoints before logic testing.
Noob Hackers
11
Enumeration & Network Vulnerabilities
FINAL CONCLUSION OR STEPS REVISED: 4. SNMP CHECK:
1. PERFORM HOST DISCOVERY: snmpwalk -v2c -c public [Link]
nmap -sn [Link]/24 Look for system OIDs, device details, interface list.
What to record: live IPs. 5. WEB ENUMERATION:
2. QUICK TCP PORT SCAN ON A FOUND HOST: curl -I [Link]
nmap -sS -p- -T4 [Link] -oN ports_20.txt gobuster dir -u [Link] -w /usr/share/wordlists/dirb/common
Record: open ports and services. nikto -h [Link]
3. SERVICE/VERSION DETECTION: Find hidden admin pages/backups.
nmap -sV -p22,80,139,445 [Link] -oN EXPECTED FINDINGS:
scans/service_20.txt
[Link] SMB shares: SharedDocs (RO), Backups (RW) — Backups a
Identify versions to research CVEs. file write.
SNMP public reveals device info and uptime.
Web server contains /admin and /[Link] accessible.
CYBER SECURITY CLASSES
Join: 9113948054
By Noob Hackers
Noob Hackers
MODULE 4 COMPLETED
CYBER SECURITY CLASSES
Join: 9113948054
By Noob Hackers