Scanning Networks and Enumeration
Scanning fundamentals
Scanning maps live hosts, open ports, services, and operating systems. Understand the TCP three-way handshake (SYN, SYN/ACK, ACK) and the flag combinations used by scan types. Key Nmap options: -sS SYN/half-open (needs root, stealthier, never completes the handshake), -sT full connect (uses the OS stack, logged by the target), -sU UDP, -sA ACK (maps firewall rules, never reports a port open), -sN/-sF/-sX null/fin/xmas, -sV version detection, -O OS fingerprinting, -Pn skip host discovery, -sI idle/zombie scan, -D decoys, -f fragmentation, -T0–-T5 timing. Port states are open, closed, filtered, unfiltered, and open|filtered (the normal UDP answer when nothing replies).
Enumeration
Enumeration extracts users, shares, groups, and services from an open port. Associate protocol to port: NetBIOS 137–139, SMB 445, SNMP 161/162, LDAP 389/636, NTP 123, RPC 135, NFS 2049, SMTP 25, DNS 53, FTP 21. Know techniques: NetBIOS NULL sessions and nbtstat -A, SMB share listing with net view/smbclient, SNMP community-string guessing and snmpwalk (a read-write string is far worse than read-only), LDAP anonymous binds, NTP mode 6 queries, RPC rpcdump, and SMTP VRFY/EXPN for username harvesting.
Traps
-sA cannot find open ports; UDP scans rarely return clean "open"; -sT is noisy and target-logged; banner grabbing is enumeration, not scanning. Also remember services may be reachable on non-standard ports, so version detection beats port-number assumptions.
Worked example
To test a Windows host for a NULL session: net use \\10.10.10.5\IPC$ "" /u:"" then net view \\10.10.10.5. Success exposes shares and account names with no credentials - report it as a high-severity misconfiguration.