CS391 Computer & Network Security enumeration CS391 Computer & Network Security

What is enumeration? Enumeration Techniques.

What is Enumeration? Having identified live hosts and running services, enumeration is the task of probing the identified services for known weaknesses. The main difference between enumeration and the previous techniques is the level of intrusiveness. Enumeration involves active connections to systems and directed queries, and accordingly will be logged by target systems.

Banner Grabbing We have seen examples of banner grabbing in the previous lecture. In addition, telenet and netcat may be used.

Banner Grabbing telnet example

Smtp enumeration Tcp port 25 Two commands: vrfy and expn Use telenet

Zone transfers Dns server port 53 Nslookup Ls –d server name

Null session enumeration Server Message Block (SMB) Protocol. Forms the basis for file and printer sharing. First step: connect to the protocol using the null session command: Net use \\IP address\IPC$ “” /u:” Enumaerate file shares on a host Net view \\host

Use DumpSec One can use Dumpsec tool to enumerate file shares. Another tool is legion Another attack is to dump the Windows registry. A number of tools can be used, e.g. regdmp

Trusted Domains Enumerating trusted domains: Once a null session is established, nltest and /server:server_name and /trusted_domains may be used to learn about further domains related to the current domians

Users Enumerating users: Use dumpsec