I85PREP
⌘ K
OSC study materials
OSC study resources

OSC: Information Gathering and Enumeration

OSC · Work through your exam, one topic at a time.

All guide sections

Information Gathering and Enumeration

The Information Gathering and Enumeration domain checks whether you can turn a bare IP address into a complete, defensible map of the target before touching an exploit. Graders reward methodical coverage: every TCP port, the common UDP services, every virtual host, and every piece of metadata a service volunteers. It is the domain where most failed attempts are actually lost, because a missed port means a missed foothold.

Core rules

  • Scan all 65,535 TCP ports first, then run version and default-script scans only against discovered ports. A fast full-range sweep plus a focused -sCV pass beats one slow aggressive scan.
  • Treat UDP separately: 53, 69, 111, 123, 137-139, 161/162, 500, 623, 2049. SNMP with a community string of public can hand you usernames, routes and sometimes command output.
  • Always test for virtual hosts and alternate paths: ffuf -w vhosts.txt -u http://10.10.10.5 -H 'Host: FUZZ.example.com' -fs <baseline size>, plus directory brute forcing with a real wordlist.
  • SMB: try null and guest sessions (smbclient -N -L //10.10.10.5, rpcclient -U '' -N), enumerate shares, then users via RID cycling.
  • DNS: attempt a zone transfer (dig axfr @10.10.10.5 example.com) before brute forcing subdomains.
  • Record every command and its output; you cannot report what you did not log.

Worked example

You find only 22, 80 and 445 open. Port 80 returns a generic welcome page with no links. Rather than assume nothing is there, you run a vhost fuzz against the IP, discover internal.example.com returning a 302, and add it to /etc/hosts. On that host a login form appears. Separately, smbclient -N -L returns a share named backups; mounting it exposes a .kdbx file and a web.config containing a connection string. The reasoning: default pages and empty-looking shares are artifacts to enumerate, not dead ends.

Traps that cost marks

Scanning only the top 1,000 ports; skipping UDP entirely; forgetting to add discovered hostnames to /etc/hosts, which makes the vhost seem to vanish; trusting a tool's no-results message without checking for filtering; and pasting tool output into notes without interpreting it.