I85PREP
⌘ K
OSCP study materials
OSCP study resources

OSCP: Information Gathering and Enumeration

OSCP · Work through your exam, one topic at a time.

All guide sections

Information Gathering and Enumeration

What to know

Reconnaissance splits into passive (WHOIS, DNS records, certificate transparency, search engines, job postings) and active (packets sent at the target). Exam labs reward breadth: run a full TCP sweep first (nmap -p- -T4 --min-rate 1000), then targeted service detection (-sC -sV -p<found>), then UDP against the usual suspects (53, 69, 111, 123, 137-139, 161, 500).

Per-service playbooks matter more than flags. SMB: smbclient -N -L, enum4linux-ng -a, rpcclient, null and guest sessions. SNMP: snmpwalk -v2c -c public and community-string guessing. NFS: showmount -e, mount the export, look for no_root_squash. LDAP: ldapsearch -x -H ldap://host -b 'dc=corp,dc=local'. SMTP: VRFY/EXPN user harvesting. DNS: attempt AXFR, then brute-force subdomains. Web: content discovery with ffuf or gobuster plus virtual-host fuzzing.

Traps

  • Treating the top-1000 scan as complete; high ports (8080, 8443, 5985, 1433, 3389) get missed.
  • Skipping UDP entirely, where SNMP and TFTP live.
  • Not re-enumerating after finding credentials; shares, LDAP and web apps look completely different authenticated.
  • Confusing -sT (full connect) with -sS (SYN); traffic through a SOCKS proxy usually needs connect scans.

Rule of thumb

Every hostname, username, or share name you discover is input to the next enumeration cycle. Log the exact command that produced each finding, because the report must be reproducible.