Reconnaissance and Enumeration · Topic 3 of 6
Enumeration Techniques
Learn enumeration: DNS records and zone transfers, SMB, SNMP, LDAP and SMTP service enumeration, web directory discovery and how to defend against it.
- 5 min
- Includes a diagram
- Enumeration pulls detailed data out of services found by scanning.
- A zone transfer copies a whole DNS zone and should be limited to authorised secondary servers.
- DNS records to know are A, AAAA, MX, NS, TXT, CNAME and PTR.
What it is
Enumeration extracts detailed information from services that scanning has already found. Where scanning asks "what is open", enumeration asks "what does this service tell us".
Typical results are hostnames, user names, shares, software versions, hidden web paths and configuration details. This information feeds the vulnerability analysis and attack phases.
How it works
DNS enumeration
The Domain Name System (DNS) maps names to addresses and holds many useful record types.
| Record | Information |
|---|---|
| A and AAAA | Internet Protocol version 4 and version 6 addresses of a host |
| MX | Mail servers for the domain |
| NS | Authoritative name servers |
| TXT | Free text, often email policy such as Sender Policy Framework (SPF) |
| CNAME | Alias pointing to another name |
| PTR | Reverse lookup from address to name |
A zone transfer (AXFR) copies the whole record set of a zone from a name server. It is meant for secondary servers, so a server that allows it to anyone is misconfigured, and the result reveals the whole internal naming scheme.
Linux shell (only against in-scope name servers):
dig example.com NS
dig axfr example.com @ns1.example.comTesters also try subdomain brute forcing from a word list, reverse lookups across an address range, and DNS tools such as dnsenum, DNSRecon, Amass and fierce.
Service discovery and enumeration
Different services leak different information. The table links common services with what testers look at.
| Service (port) | What may be enumerated |
|---|---|
| Server Message Block, SMB (445) | Shares, users, groups, policy, and whether a null session is allowed |
| Simple Network Management Protocol, SNMP (161 UDP) | Device details, interfaces and routes, when the community string is guessable |
| Lightweight Directory Access Protocol, LDAP (389, 636 secure) | Users, groups and directory structure |
| Simple Mail Transfer Protocol, SMTP (25) | Valid user names if verification commands are enabled |
| Network File System, NFS (2049) | Exported file systems |
| Kerberos (88) | Valid account names in a Windows domain |
| Secure Shell, SSH (22), and Remote Desktop Protocol, RDP (3389) | Versions, supported algorithms, banners |
A null session is an anonymous connection that old Windows configurations allowed. SNMP versions 1 and 2c use a community string like a shared password, with "public" being a well known default.
User enumeration is a common goal. A login form that says "unknown user" versus "wrong password" lets a tester tell valid accounts from invalid ones, so it is a finding in its own right.
Directory and content enumeration
Web servers often hold paths that are not linked from any page, such as admin panels, backups and old test folders. Directory enumeration requests many candidate paths from a word list and notes which ones return something other than "not found".
Common tools are Gobuster, Dirb, DirBuster and ffuf. The tester reads the HTTP status codes: 200 means found, 301 or 302 mean redirect, 403 means forbidden but present, and 404 means not found.
Web enumeration also includes reading page source, robots.txt files, sitemaps and technology fingerprints from headers and cookies.
Wireless enumeration
Wireless enumeration lists nearby networks and clients: service set identifiers (SSIDs), basic service set identifiers (BSSIDs), channels, the encryption type such as WEP, WPA2 or WPA3, and connected clients. A wireless card in monitor mode and tools such as Kismet or inSSIDer collect this information.
WAF detection and origin address
A web application firewall (WAF) can often be detected from response headers and behaviour. Testers also look for the origin server address behind it, using historical DNS records, certificate details and subdomains, because reaching the origin directly can bypass the WAF.
Web crawling
Web crawling, or spidering, follows links to map a site's pages and parameters, and tools such as the Burp Suite or ZAP (Zed Attack Proxy) spider automate it. It differs from forced browsing, which requests paths from a word list whether or not they are linked.
Defending against enumeration
- Refuse zone transfers except from named secondary servers.
- Disable anonymous SMB and LDAP access, and avoid SNMP v1 and v2c, using v3 instead.
- Return identical error messages for unknown users and wrong passwords.
- Remove backups and test content from web roots, and rate limit repeated requests.
- Alert on bursts of requests for missing paths.
Brute force path and name lists can generate thousands of requests, so they must fit the testing window and the capacity of the target.
What to remember for the exam
- Enumeration pulls detailed data out of services found by scanning.
- A zone transfer copies a whole DNS zone and should be limited to authorised secondary servers.
- DNS records to know are A, AAAA, MX, NS, TXT, CNAME and PTR.
- SMB uses port 445, SNMP uses UDP 161, LDAP uses 389 and 636, SMTP uses 25, and Kerberos uses 88.
- SNMP v1 and v2c rely on community strings, with "public" as a typical default, while v3 adds authentication and encryption.
- Directory enumeration uses word lists and status codes, with tools such as Gobuster, Dirb and ffuf.
- Different error messages for unknown user and wrong password allow user enumeration.
- Findings from enumeration drive vulnerability analysis and later attacks.
Common mistakes
Mixing scanning with enumeration. Scanning finds ports and services, and enumeration interrogates them for details.
Reading 403 as "does not exist". A 403 means the server knows the path and refuses access, which is still useful information.
Forgetting UDP for SNMP. An SNMP check that scans only TCP will miss it.
Using huge word lists without limits. Large lists can overload small servers or trigger lockouts.
Reporting a zone transfer as harmless. It exposes internal hostnames and often hints at a wider misconfiguration.
Check yourself
Which DNS record type lists a domain's mail servers?
MX.
What makes a zone transfer a finding?
A name server that allows anyone to copy the whole zone exposes internal hostnames and structure.
What does an HTTP 403 response tell a tester during directory enumeration?
The path exists but access is forbidden.
Topic 3 of 6 in Reconnaissance and Enumeration
Test yourself on Reconnaissance and Enumeration
The full CompTIA PenTest+ PT0-003 question bank has 653 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.