Service enumeration reference
Enumerate every reachable service before exploiting anything: full TCP port scan, then version and script scans, then check each service for default logins, exposed shares, and known vulnerabilities in the exact version. A service you scanned but never looked at is the most common cause of a stuck box.
Most exam failures on the practical side are not missed exploits. They are missed enumeration — a service that was open, that you scanned, and that you did not actually look at. This is a checklist against that.
The order matters less than the completeness. What kills people is declaring a host “fully enumerated” when they have run one tool against one port.
The rule
Enumerate every service you can reach before you exploit anything. A shell you find in the first ten minutes is worth less than knowing the whole attack surface, because the easy shell is often not the intended path and burns time you needed elsewhere.
Start wide, then narrow
A full TCP port scan first — all 65,535 ports, not the default top thousand. The service that gets people through a box is disproportionately the one on a high, non-standard port that a default scan skipped. Then a version and script scan against only the ports you found open.
Note the versions. A version number is a search query, and a large share of boxes come down to a known vulnerability in a specific version of a specific service.
By service
FTP (21). Try anonymous login first — it is free and it works more often than it should. If you get in, check for writable directories and for files that other services might execute. Note the FTP software version.
SSH (22). Rarely the way in by itself, but the version tells you the OS and patch era. Note it and move on unless you already have credentials to try.
SMTP (25). User enumeration via VRFY / EXPN / RCPT TO where the
server allows it. A list of valid usernames feeds everything downstream.
DNS (53). Attempt a zone transfer. When it works it hands you the entire internal namespace, which reshapes the whole engagement.
HTTP/HTTPS (80, 443, and anything else). The biggest surface on most hosts.
Identify the technology stack, then enumerate directories and files, then look
at every input. Check the TLS certificate — the common name and SANs leak
internal hostnames and virtual hosts you would not otherwise find. Read the
page source. Look for a robots.txt, an admin panel, a login, a version string
in a footer.
Kerberos (88). A domain controller. This is the pivot point for every Active Directory attack path — note it and come back to it with the AD methodology.
RPC / NetBIOS / SMB (135, 139, 445). Enumerate shares, try a null session, list users and password policy where you can. SMB is the workhorse of Windows and AD compromise, and a readable share is a common foothold.
LDAP (389, 636). Query it anonymously where allowed. Domain structure, users, groups, and occasionally credentials in description fields.
SQL (1433, 3306, 5432). Try default and weak credentials. A database login frequently escalates straight to command execution or code execution on the host.
WinRM (5985, 5986). If you have credentials, this is often the cleanest way onto a Windows host. Worth remembering the moment you find any valid login.
When to stop enumerating a service
When you have: its version, its authentication state (open, weak, locked), and a note of what it exposes. If you cannot say those three things about an open port, you have not finished with it.