Service Enumeration
Deep enumeration extracts detailed information from discovered services to identify misconfigurations, credentials, and attack vectors for exploitation. Each protocol requires specific tools and techniques.
Tip
Danger
xp_cmdshell, collecting
BloodHound session data); the rule that applies across all of them is that a read stays a read unless
the rules of engagement say otherwise.
Enumeration Guides
SMB Enumeration
Port 445Enumerate SMB shares, users, and sensitive files. Null session testing, spidering, and relay attack setup.
LDAP & Active Directory
Port 389/636Query LDAP for users, groups, computers, GPOs, trusts. PowerView, ldapdomaindump, and windapsearch.
Kerberos Enumeration
Port 88User enumeration, AS-REP roasting, Kerberoasting, and delegation discovery. Kerbrute, Rubeus, and Impacket.
DNS Enumeration
Port 53Zone transfers, SRV records, ADIDNS poisoning, and reverse lookups. DNSrecon and adidnsdump.
Database Enumeration
Port 1433/3306MSSQL, MySQL, PostgreSQL enumeration. xp_cmdshell, linked servers, and credential extraction.
Cloud & Hybrid
Azure/M365Azure tenant discovery, M365 endpoint enumeration, service principal mapping, and cloud credential discovery from internal network.
Enumeration Workflow
Information
Recommended Order
- SMB - Null sessions, shares, sensitive files
- DNS - Zone transfers, SRV records, host discovery
- LDAP - Users, groups, password policies
- Kerberos - AS-REP roast, Kerberoast, delegation
- Databases - Default creds, linked servers, command execution
Quick Reference
| Service | Ports | Quick Win Tools |
|---|---|---|
| SMB | 445, 139 | nxc smb -u '' -p '' --shares |
| LDAP | 389, 636 | ldapdomaindump -u 'user' -p 'pass' ldap://DC |
| Kerberos | 88 | kerbrute userenum -d DOMAIN users.txt |
| DNS | 53 | dig @DC DOMAIN AXFR |
| MSSQL | 1433 | nxc mssql -u user -p pass -x whoami |
Evidence Collection
This page collects no artefacts of its own — each child page carries its own evidence block. What belongs here is the shape of the record, because a per-service result is only usable if it names the host, the credential and the proof.
One row per service: Host, port, engine and version, the credential used, what it returned, and the path to the saved output. Without the credential column you cannot tell an anonymous finding from an authenticated one.
Credential ledger: Every account used or recovered, where it was found, what it authenticates to and whether the client authorised its use. This is the file you destroy at the end of the engagement.
Per-service output:
The raw tool output for anything you intend to report — nxc rows, LDAP dumps, sp_configure output. Verbatim first, summarised second.
False Positive Identification
- One credential working twice: A password that authenticates to SMB and SQL on the same host proves local reuse, not estate-wide reuse. The finding needs a second host or a second service on a different host.
- A banner is not a version: Engines report patch levels inconsistently, and a proxy or appliance in front can rewrite the banner. Confirm exploitable versions against the host inventory.
-
Listable is not readable:
A share that appears in
--sharesbut returnsACCESS_DENIEDwhen opened is not exposure. Record the permission result, not just the name. - A default credential with no privilege: A working default login on a database nobody queries is a process finding, not data access. Say what the account can reach before grading it.
Remediation & Defense
The cross-cutting fixes, independent of which service the finding came from.
Credential hygiene
- • Remove default and shared local-admin passwords; use LAPS or a PAM for the rest
- • Give service accounts their own identity with the minimum rights the service needs
- • Treat any credential found on a share as compromised and rotate it, not just delete the file
Service hygiene
- • Remove or restrict anonymous access to SMB, LDAP and database listeners
- • Do not expose database and management ports to the user VLAN
- • Keep engines on supported versions, and log authentication failures centrally