Reconnaissance Techniques · Topic 8 of 8
NTP, NFS, SMTP, DNS and Other Enumeration
Review enumeration of NTP, NFS, SMTP, DNS, IPsec, VoIP, RPC, FTP, SMB, IPv6 and BGP with their ports and tools, and the countermeasures that stop it.
- 5 min
- NTP is UDP 123, NFS is port 2049 with rpcbind on 111, SMTP is 25, TFTP is UDP 69, BGP is TCP 179, IKE is UDP 500, SIP is 5060.
- VRFY, EXPN and RCPT TO are the SMTP enumeration commands.
- enum4linux and smbclient are the usual SMB enumeration tools.
What it is
Every network service can answer questions that help an attacker. This page covers the remaining services in the enumeration list, the ports to link with each, and the countermeasures that apply to the whole group.
For the exam, the useful skill is to match a port or protocol to what it reveals and to the tool or fix.
How it works
NTP and NFS enumeration
The Network Time Protocol (NTP) keeps clocks in step, and it uses UDP 123. Querying an NTP server can reveal the hosts that connect to it, the operating system and the server's own sources. Tools include ntpdate, ntptrace, ntpdc, ntpq and Nmap's NTP scripts.
The Network File System (NFS) shares directories between Unix and Linux systems on TCP and UDP port 2049, and it relies on the RPC port mapper on port 111. The showmount command lists the exports of a server, and rpcinfo lists RPC services. A share exported too widely can be mounted by anyone, so the tester checks for exports open to all hosts or with root access allowed.
SMTP and DNS enumeration
The Simple Mail Transfer Protocol uses TCP port 25 for server to server mail, 587 for client submission and 465 for implicit TLS. Three commands help guess valid users.
| SMTP command | What it does | What it can reveal |
|---|---|---|
| VRFY | Asks whether a user name exists | Valid account names |
| EXPN | Expands a mailing list | Members of a list |
| RCPT TO | Names a recipient during a message | Accepted or rejected recipients |
Tools include smtp-user-enum, Nmap's smtp-enum-users script and Metasploit scanners. Telnet or Netcat connected to port 25 shows the same behavior.
DNS enumeration repeats the footprinting ideas against the name servers: zone transfers, brute force of host names, reverse lookups and querying record types. Tools include dig, nslookup, DNSRecon and dnsenum. DNSSEC signs records to prevent forgery, but it does not stop zone data being read unless transfers are restricted.
Other enumeration techniques
| Service | Port | What enumeration reveals | Typical tool or technique |
|---|---|---|---|
| IPsec (IKE) | UDP 500 | VPN gateway presence, supported transforms and authentication mode | ike-scan |
| VoIP (SIP) | 5060, 5061 for TLS | Extensions, user agents, call servers | SIPVicious, Nmap scripts |
| RPC | TCP 111 and 135 | Registered programs and services | rpcinfo, rpcclient |
| Unix and Linux | finger on 79, rusers, rwho | Logged-in users and last logins | finger, rusers, showmount |
| Telnet | TCP 23 | Banner and login prompt | Telnet client, Nmap scripts |
| FTP | TCP 21 | Banner, anonymous access and directory listing | FTP client, Nmap scripts |
| TFTP | UDP 69 | Files that can be fetched without authentication | tftp client |
| SMB | TCP 445 | Shares, users, groups, policies | enum4linux, smbclient, Nmap scripts |
| IPv6 | various | Neighbors on the local link, addresses in use | Nmap with -6, THC-IPv6 tools |
| BGP | TCP 179 | Autonomous system numbers, prefixes, peers | Looking glass servers, route registries |
Some points to remember:
- TFTP has no authentication, so a file can be fetched if its name is known.
- IPv6 hosts answer on the all-nodes multicast address, so a single probe on the local link finds many devices. Scanning the huge IPv6 address space blindly is impractical.
- BGP data is mostly public, and it shows how the organization connects to the internet.
- Telnet and FTP send credentials in clear text.
Enumeration countermeasures
- Disable services that are not needed, and close their ports at the firewall.
- Restrict zone transfers, NFS exports, SMB shares and directory reads to named hosts and users.
- Disable anonymous access, null sessions and default accounts.
- Disable VRFY and EXPN on mail servers.
- Replace Telnet, FTP and TFTP with SSH, SFTP or FTPS, and use SNMP version 3.
- Use strong passwords and account lockout, and change default community strings and credentials.
- Filter NTP so that it only answers trusted hosts and limit monitor commands.
- Use IPsec with strong authentication and hide VPN gateways that do not need to be public.
- Segment the network and monitor for large numbers of queries.
A worked example
A tester connects to port 25 on a mail relay and asks whether the user "backup" exists. The server confirms with VRFY, and a short list of common names shows which accounts are real. The fix is to disable VRFY and EXPN and to return the same response for all recipients.
How the exam asks about this
- "Which command lists the NFS exports on a server?" -> showmount.
- "Which SMTP command asks whether a user exists?" -> VRFY.
- "Which tool is used to discover IPsec VPN gateways?" -> ike-scan.
What to remember for the exam
- NTP is UDP 123, NFS is port 2049 with rpcbind on 111, SMTP is 25, TFTP is UDP 69, BGP is TCP 179, IKE is UDP 500, SIP is 5060.
- VRFY, EXPN and RCPT TO are the SMTP enumeration commands.
- enum4linux and smbclient are the usual SMB enumeration tools.
- TFTP has no authentication, and Telnet and FTP are in clear text.
- Countermeasures: disable unused services, restrict access, encrypt and monitor.
Telnet (port 23) is not SSH (port 22). A question that asks about clear text remote access points to Telnet.
Common mistakes
Treating DNSSEC as a defense against zone transfers. It protects the integrity of records, not their secrecy.
Mixing up finger and fingerprinting. Finger is an old Unix user lookup service, while fingerprinting identifies an operating system.
Forgetting that SMTP has several ports. Server relay uses 25, submission uses 587 and 465 is used with implicit TLS.
Check yourself
Which port does NTP use?
UDP 123.
What does the SMTP command EXPN do?
It expands a mailing list to show its members.
Name two countermeasures against SMB enumeration.
Disabling anonymous access and null sessions, and blocking port 445 from untrusted networks.
Topic 8 of 8 in Reconnaissance Techniques
Test yourself on Reconnaissance Techniques
The full EC-Council 312-50 question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.