Hacking Series: Enumerating Network Services
There is an old saying in offensive security: enumeration is the phase where engagements are won or lost. It is not glamorous. Nobody makes a film about someone patiently listing SMB shares. But sit with any experienced tester after a successful assessment and ask where the win actually came from, and the answer is almost never “a clever exploit”. It is “I found an anonymous FTP login nobody knew about” or “SNMP was wide open and handed me the whole config”.
Exploitation gets the attention. Enumeration does the work.
This guide is about that work: the careful, methodical process of finding out exactly what is running on a target and pulling every useful detail out of it before you attempt anything. It is the second entry in the hacking series; if you have not read the command-line tools primer yet, that is worth a look first, because everything here happens in a terminal.
The mindset: know before you touch
The single most common mistake I see in people learning this is rushing. They run one quick scan, see a familiar service, and immediately go looking for an exploit for it. Nine times out of ten they get stuck, because they skipped past the information that would have told them exactly what to do.
Enumeration is the opposite of that instinct. It is slow on purpose. The goal is to build a complete, boring, detailed picture of the target: every open port, every service, every version, every account, every share, every misconfiguration. When that picture is complete, the way in is usually obvious. It has been sitting in your notes the whole time.
So the rule is: enumerate first, exploit last, and enumerate more than feels necessary.
Step one: find the open ports
Everything starts with a port scan, and the tool is Nmap. A port is just a numbered door on a machine; an open one means some service is listening behind it, and IANA maintains the registry of which numbers conventionally belong to which service. Your first job is to find them all.
A basic scan looks like this:
nmap 10.10.10.5That checks the 1,000 most common ports. It is fine for a quick look, but it misses anything on an unusual port, and interesting things love to hide on unusual ports. For a real assessment, scan all of them:
nmap -p- 10.10.10.5-p- means “every port, 1 to 65535”. It is slower, but the service someone quietly moved to port 8443 or 50000 is exactly the one that has not been hardened. Do the full scan.
Once you know which ports are open, you stop scanning broadly and start looking closely.
Step two: identify the services and versions
An open port tells you something is there. It does not tell you what. Port 80 usually means a web server, but which one? Running what version? That detail is the difference between “there’s a web server” and “there’s an outdated web server with a publicly known vulnerability”.
Nmap’s version detection does this:
nmap -sV -sC -p 22,80,445 10.10.10.5Two flags carry the weight. -sV probes each open port to identify the exact software and version: not just “SSH” but “OpenSSH 7.2p2”. -sC runs Nmap’s default set of scripts, which do a first pass of enumeration automatically: grabbing banners, checking for anonymous access, listing basic information. I run this combination on the open ports of nearly every target. It is the workhorse command.
Why does the version matter so much? Because a version number is a lookup key. Once you know a service is running a specific version, you can check whether that version has known, published vulnerabilities. A huge share of real-world compromises are nothing more than “the software was three years out of date and had a documented flaw”. Enumeration finds the version; the version tells you the rest.
Write everything down as you go. On a real engagement you will have dozens of ports across multiple hosts, and a tidy set of notes (port, service, version, findings) is what keeps you from missing the one detail that mattered.
Step three: go deep on each service
Now the real enumeration begins. For each open service, you connect and pull out everything you can. Different services leak different things, so let us go through the ones that reward attention most.
SMB (port 445): the classic goldmine
SMB is Windows file sharing, and it is one of the richest sources of information on a network. Misconfigured SMB can hand over a list of user accounts, the names of shared folders, and sometimes the contents of those folders, occasionally including passwords, backups, and configuration files someone left on a share “temporarily” in 2021.
Two tools do most of the work. enum4linux throws everything at an SMB host at once: users, shares, groups, policies.
enum4linux -a 10.10.10.5And smbclient lets you list and browse shares directly, testing whether you can get in with no credentials at all:
smbclient -L //10.10.10.5/ -NThe -N means “no password”. You would be amazed how often that works. An anonymous, readable share is one of the most common ways into an internal network.
SSH (port 22)
SSH is hardened by design, so you are not usually breaking the encryption. What you enumerate here is the version (again, for known flaws), the authentication methods it allows, and sometimes the banner it presents. If password authentication is enabled and you have found usernames elsewhere, SSH becomes a place to test weak credentials, carefully, and only in scope. The tool for that side of things is covered in the password cracking with Hydra guide.
HTTP and HTTPS (ports 80 and 443)
A web service is an entire attack surface on its own, and it is where most modern findings live. Enumeration here means identifying the server and framework, discovering hidden pages and directories with a tool like ffuf, reading the security headers, and then testing the application itself through Burp Suite. Web enumeration is deep enough to be its own discipline; from the network-enumeration point of view, the key move is simply: an open web port means stop and do a full web assessment.
FTP (port 21)
FTP’s headline enumeration check is anonymous login: many FTP servers allow you to log in with the username anonymous and no real password.
ftp 10.10.10.5Try anonymous as the username and anything as the password. If it works, list the files. Anonymous FTP with readable (or worse, writable) directories is a gift, and it turns up far more than it should.
DNS (port 53)
DNS can reveal the internal structure of a network if it is misconfigured. The prize is a zone transfer: asking the DNS server to hand over its entire list of records, which maps out hostnames and internal addresses in one request:
dig axfr @10.10.10.5 targetdomain.localMost servers correctly refuse this. The ones that do not give you a map of the whole environment. It costs one command to check.
SNMP (port 161, UDP)
SNMP is easy to forget because it runs over UDP and standard TCP scans miss it, but when it is enabled with a default “community string” like public, it can leak a staggering amount of detail: running processes, installed software, network interfaces, user accounts, sometimes credentials. Walk it with:
snmpwalk -v2c -c public 10.10.10.5If it responds, read carefully. Misconfigured SNMP is one of those findings that quietly hands over half the target.
A few more services worth knowing
The services above cover most engagements, but a handful of others turn up often enough to keep on your radar, and they leak useful things when misconfigured.
SMTP, port 25, can sometimes be asked whether a given username exists, using its own built-in verification commands. If it answers honestly, you can confirm valid account names before you ever try a password, a quiet way to build the username list that later feeds into a password test. Not every server allows it, but it costs nothing to check.
NFS, port 2049, is Unix file sharing, the cousin of SMB. A misconfigured NFS server may let you list and mount its shared folders with no authentication at all, and once mounted, they behave like a local folder full of someone else’s files. Check which shares are exported before assuming there is nothing there.
LDAP, port 389, is the directory service behind a lot of corporate logins, and an LDAP server that permits anonymous queries can hand over a detailed list of users, groups and organisational structure. On a Windows network especially, that is a map of who is who.
The pattern across all of these is the one this whole guide is built on: an open port is an invitation to ask the service what it knows, and misconfigured services answer far more generously than they should.
Do not forget UDP
One easy mistake trips up almost everyone: most port scans only check TCP by default, and several of the richest services, SNMP and NFS among them, live on UDP. A UDP scan is slower and less reliable, so people skip it, and then miss the wide-open SNMP that would have handed them the whole configuration. Run at least a targeted UDP scan of the common ports so these do not slip past you:
nmap -sU --top-ports 20 10.10.10.5It takes longer than a TCP scan, but the services hiding on UDP are exactly the ones nobody else bothered to check.
Turning findings into a plan
By the time you have worked through every open service, you should have pages of notes. Now you connect the dots. This is where enumeration pays off.
You cross-reference. The version numbers you collected get checked against public vulnerability databases: is anything running a release with a known flaw? The usernames you pulled from SMB get lined up against the SSH and web login pages: can any of them be reached with a weak password? The files you found on that anonymous share: do any of them contain credentials that unlock something else?
Real intrusions are usually a chain: a username from SMB, a password from an FTP file, reused on an SSH login. No single step is clever. The cleverness is in the enumeration that gathered every piece so the chain could be assembled. Nobody hands you the chain. You build it from the boring details.
Being methodical (and staying legal)
Two habits separate people who are good at this from people who are stuck.
Take notes obsessively: port, service, version, what you tried, what you found. When you have twenty open ports across five hosts, memory fails and notes win. The detail you skimmed past on host two is often the key to host four.
Do not skip services because they look boring. The unglamorous ports (SNMP, FTP, an odd service on a high port) are exactly where the forgotten misconfigurations live, because nobody pays attention to them. The flashy web app is hardened; the printer’s management service is not.
And the line that never moves: all of this sends real traffic to the target, so all of it requires authorisation. Port scanning and enumeration against systems you do not own or have written permission to test is unlawful in most places, full stop. Practise on deliberately vulnerable labs, such as Hack The Box, TryHackMe, and VulnHub machines that exist for exactly this. On a real engagement, stay strictly inside the agreed scope. Discovering a service is not permission to attack it.
Where this fits
Enumeration is the foundation everything else is built on. Exploit code is useless if you do not know what to point it at, and the difference between a frustrating engagement and a productive one is almost always the depth of the enumeration behind it.
The rest of this series builds outward from here: the command-line tools you do it all with, Hydra for testing the credentials you uncover, and the web-focused tools (ffuf, Burp Suite) for when an open web port turns into a whole application to test.
To go deeper, the Nmap reference guide documents every flag, and the NSE script index lists the hundreds of service-specific scripts that do much of this work for you. Nmap maintains scanme.nmap.org as a host you are explicitly permitted to scan while you learn. For methodology, NIST’s SP 800-115 is the standard technical guide to security testing, and HackTricks is the community reference for what to do with each service once you find it.
Slow down, enumerate everything, write it all down. The way in is almost always already in your notes. If you want to build this instinct properly with guided labs, that is what our training is for.
