MODULE 4
ENUMERATION & NETWORK
VULNERABILITIES
THINK, PLAN, SECURE
Presented by
NAKEEB CYBER SECURITY CLASSES
Join: 9113948054
By Noob Hackers
Noob Hackers
01
Enumeration & Network Vulnerabilities
INTRO
how to gather detailed info about hosts, services, and configurations so they
can identify weak points to test or defend.
Topic 1 — Network Discovery & Service Fingerprinting
Topic 2 — SMB / Windows Enumeration
Topic 3 — Application/Service Enumeration: SNMP, Webapps
CYBER SECURITY CLASSES
Join: 9113948054
By Noob Hackers
Noob Hackers
02
Enumeration & Network Vulnerabilities
Topic 1 : Network Discovery & Service Fingerprinting
Command: sudo nmap -sV --script=http-enum,http-vhosts -p 80,443 [Link]
WHAT IT DOES:
Find live hosts, open ports and identify services/versions (the first step before deeper enumeration).
nmap -sS -p- -T4 [Link]
Full TCP SYN scan across all ports.
nmap -sV -p22,80,139,445 --version-intensity 5 [Link]
Service/version detection on specific ports.
nmap -sU -p161 [Link]
Basic UDP scan for SNMP. (Simple Network Management Protocol), is a standard protocol for monitoring and managing network
devices like routers, switches, and servers.
masscan [Link]/24 -p1-65535 --rate=10000
Very fast port discovery (use carefully).
nc -v [Link] 25 or curl -I [Link]
Banner grabbing / quick manual checks.
CYBER SECURITY CLASSES
Join: 9113948054
By Noob Hackers
Noob Hackers
03
Enumeration & Network Vulnerabilities
masscan [Link]/24 -p1-65535 --rate=10000
WHAT IT DOES:
Very fast asynchronous port scanner (like a shotgun for ports). It floods the network to find open ports at extreme speed.
Flags explained:
[Link]/24 — target network.
-p1-65535 — all ports.
--rate=10000 — packets per second; higher = faster but more likely to drop/trigger.
OUTPUT:
Discovered open port 80/tcp on [Link]
Discovered open port 22/tcp on [Link]
INDUSTRY USE:
Quickly map large IP blocks to find targets for deeper scans.
EXPLANATION:
Discovery finds which IPs respond (ping sweep / ARP / SYN).
Fingerprinting analyzes banners, protocol quirks and version strings so you can decide which exploits or follow-ups to try.
UDP is slow/noisy — test selectively.
EXAMPLE:
nmap -sS -p22,80,139,445 -T4 -oA demo/scan1 [Link] → shows 22/tcp ssh OpenSSH 7.2p2, 445/tcp Microsoft-DS, 80/tcp
Apache httpd 2.4.18
version strings guide whether to attempt known CVE research or safe config checks.
INDUSTRY USE: CYBER SECURITY CLASSES
Pen-testing/Red team: initial reconnaissance to scope attack surface. Join: 9113948054
Blue team/Defenders: use for asset inventory, detect unexpected services. By Noob Hackers
SOC/IR: replicate attacker reconnaissance to understand attack vector.
Noob Hackers
MODULE 4.1
SMB / WINDOWS
ENUMERATION
CYBER SECURITY CLASSES
Join: 9113948054
By Noob Hackers
Noob Hackers
04
Enumeration & Network Vulnerabilities
Topic 2: SMB / Windows Enumeration
Command: smbclient -L //[Link] -U (or) smbclient //[Link]/Private -U testuser -m SMB3
WHAT IT DOES:
“SMB" can refer to Server Message Block, a network protocol for file and printer sharing,Lists SMB/CIFS shares and basic server info on
the target. Useful for quick discovery of share names, whether anonymous listing is allowed, and whether IPC or admin shares exist.
FLAGS:
-L //host — list shares on host.
SAMPLE OUTPUT:
Domain=[MYDOMAIN] OS=[Windows 10] Server=[Samba 4.11]
Sharename Type Comment
--------- ---- -------
SharedDocs Disk Public Documents
Backups Disk Backup folder (writable)
IPC$ IPC IPC Service (remote admin) CYBER SECURITY CLASSES
C$ Disk Default share Join: 9113948054
SMB1 disabled -- no protocol mismatch By Noob Hackers
INDUSTRY USE:
Red Team / pentest: find writable shares (e.g., Backups) to drop or retrieve files; check for exposed backup files or credentials.
Blue Team / Audit: confirm which administrative shares exist and whether anonymous list is permitted.
Forensics: quickly map possible exfil routes.
Noob Hackers
05
Enumeration & Network Vulnerabilities
Topic 2: SMB / Windows Enumeration
Command: enum4linux -a [Link] (Or) enum4linux -u testuser -p "YourPassword" -a [Link]
WHAT IT DOES:
Runs a collection of SMB/NetBIOS enumeration routines (wrappers for rpcclient, smbclient, smbmap-like actions) to collect user lists,
groups, password policy, shares, sessions, and domain info. -a runs all aggressive checks.
FLAGS:
-a — run all tests (aggressive mode: user enum, share enum, group enum, RID cycling, password policy).
SAMPLE OUTPUT:
[I] Found new SID:
S-1-5-32
[I] Found new SID:
S-1-5-32
CYBER SECURITY CLASSES
[I] Found new SID: Join: 9113948054
S-1-5-21-198977502-3789435691-2866211877 By Noob Hackers
INDUSTRY USE:
Red Team: one-shot tool to collect most SMB-related intel.
Blue Team: emulate an attacker and catch weak policies or exposed users.