# Module 04:  Enumeration

## Lab 1: Perform NetBIOS Enumeration <a href="#lab-1-perform-netbios-enumeration" id="lab-1-perform-netbios-enumeration"></a>

### Task 1: Perform NetBIOS Enumeration using Windows Command-Line Utilities <a href="#task-1-perform-netbios-enumeration-using-windows-command-line-utilities" id="task-1-perform-netbios-enumeration-using-windows-command-line-utilities"></a>

```
## Commands used : 
1. Netbios name table: nbtstat -a [IP address of the remote machine]
2. Netbios cache : nbtstat -c 
3. File Shares enumeration : net use
```

## Lab 2: Perform SNMP Enumeration <a href="#lab-2-perform-snmp-enumeration" id="lab-2-perform-snmp-enumeration"></a>

### Task 1: Perform SNMP Enumeration using SnmpWalk <a href="#task-1-perform-snmp-enumeration-using-snmpwalk" id="task-1-perform-snmp-enumeration-using-snmpwalk"></a>

```
## Commands used :
1. SNMP V1 : snmpwalk -v1 -c public [target IP]
2. SNMP V2c : snmpwalk -v2c -c public [Target IP Address]   
```

## Lab 3: Perform LDAP Enumeration <a href="#lab-3-perform-ldap-enumeration" id="lab-3-perform-ldap-enumeration"></a>

### Task 1: Perform LDAP Enumeration using Active Directory Explorer (AD Explorer) <a href="#task-1-perform-ldap-enumeration-using-active-directory-explorer-a-d-explorer" id="task-1-perform-ldap-enumeration-using-active-directory-explorer-a-d-explorer"></a>

{% hint style="info" %}
Tools used in this section :&#x20;

1. &#x20;**Active Directory Explorer**
2. **Softerra LDAP Administrator**
3. **LDAP Admin Tool**&#x20;
4. **LDAP Account Manager**
5. **LDAP Search**
{% endhint %}

## Lab 4: Perform NFS Enumeration <a href="#lab-4-perform-nfs-enumeration" id="lab-4-perform-nfs-enumeration"></a>

```
## Commands used : 
1.  Nmap Port Scan : nmap -p 2049 [Target IP Address]
```

{% hint style="info" %}
Tools used in this section :&#x20;

1. SuperEnum :&#x20;
   1. **echo "10.10.1.19" >> Target.txt**
   2. **chmod +x superenum**
   3. **./superenum**
2. **RPCScan :**&#x20;
   1. **python3 rpc-scan.py \[Target IP address] --rpc**
{% endhint %}

## Lab 5: Perform DNS Enumeration <a href="#lab-5-perform-dns-enumeration" id="lab-5-perform-dns-enumeration"></a>

### Task 1: Perform DNS Enumeration using Zone Transfer <a href="#task-1-perform-dns-enumeration-using-zone-transfer" id="task-1-perform-dns-enumeration-using-zone-transfer"></a>

```
## DNS Zone transfer using Dig
    dig ns [Target Domain]
    dig @[NameServer] [Target Domain] axfr 
```

```
## DNS Zone transfer using Nslookup
    nslookup <interactive mode to be used>
        set querytype=soa
        ls -d [Name Server]
```

## Lab 6: Perform SMTP Enumeration <a href="#lab-6-perform-smtp-enumeration" id="lab-6-perform-smtp-enumeration"></a>

### Task 1: Perform SMTP Enumeration using Nmap <a href="#task-1-perform-smtp-enumeration-using-nmap" id="task-1-perform-smtp-enumeration-using-nmap"></a>

```
## Commands used in this section : 
1.  NMAP
    nmap -p 25 --script=smtp-enum-users [Target IP Address]
    nmap -p 25 --script=smtp-open-relay [Target IP Address]
    nmap -p 25 --script=smtp-commands [Target IP Address]
```

## Lab 7: Perform Enumeration using Various Enumeration Tools <a href="#lab-7-perform-enumeration-using-various-enumeration-tools" id="lab-7-perform-enumeration-using-various-enumeration-tools"></a>

### Task 1: Enumerate Information using Global Network Inventory <a href="#task-1-enumerate-information-using-global-network-inventory" id="task-1-enumerate-information-using-global-network-inventory"></a>

{% hint style="info" %}
Tools used in this section :&#x20;

1. &#x20;**Global Network Inventory**
{% endhint %}

