PJPT: Scanning and Enumeration

What the exam tests

Scanning and enumeration is where you turn a list of IPs into attack paths. The exam tests service discovery, version detection, SMB/LDAP/Kerberos enumeration, and the discipline to separate open ports from exploitable weaknesses.

Core rules and concepts

• Use nmap -sC -sV -p- for full TCP discovery; add -sU --top-ports 50 for common UDP services.
• Enumerate SMB with enum4linux-ng, smbclient, rpcclient, and NetExec smb --users; check signing, shares, and null sessions.
• Query LDAP with ldapsearch -x -H ldap://10.10.10.5 -b 'dc=corp,dc=local' to collect users, groups, and password policy.
• Kerberos user enumeration with kerbrute userenum is low-noise and reveals valid accounts without failed logons in the same way as password spraying.
• Confirm WinRM (5985/5986) and RDP (3389) access with valid credentials rather than assuming from an open port.

Worked example

Nmap shows 88, 389, 445, and 3389 open on 10.10.10.5. enum4linux-ng returns a null-session user list. kerbrute userenum --dc 10.10.10.5 -d corp.local users.txt confirms asmith and jdoe are valid. NetExec smb 10.10.10.5 -u asmith -p '' --shares fails, but --users with guest shows more accounts. Reasoning: port 88 confirms Kerberos, so user enumeration should use Kerberos rather than SMB brute force; open 3389 is only useful once credentials are valid.

Traps

Relying only on default Nmap scripts, skipping UDP, missing non-standard ports, and treating 'port open' as 'service vulnerable.' Also common: not enumerating SMB shares recursively, and not checking whether SMB signing is required before planning a relay.