Reference no: EM133999888
Tutorial - Enumeration
This tutorial complements the Week 2 lecture (concepts) by providing practical, step-by-step guidance.
1. Safety (read first)
• Only scan systems you own or instructor-provided targets.
• Use VirtualBox host-only networking to isolate labs from the internet.
• Attacker VM: Kali Linux (default), or alternatively BackBox or Parrot.
• Targets:
- Option A: Juice Shop (Docker, localhost:3000)
- Option B: Metasploitable2 (VirtualBox VM, host-only IP e.g. 192.168.56.101)
• Wireshark is optional this week (recommended for capture).
• If you see real personal data, stop immediately and notify your tutor.
2. Workspace setup
mkdir -p ~/lab_enum/week2 && cd ~/lab_enum/week2
echo "$(date) | START Enumeration | operator: <YourName> | ID: <YourID>" >> commands-log.txt
3. Windows/SMB Enumeration
nbtscan <targetIP> > nbtscan-<targetIP>.txt
enum4linux -a <targetIP> > enum4linux-<targetIP>.txt
smbclient -L //<targetIP>/ -N > smbshares-<targetIP>.txt
4. Service and Directory Enumeration
nmap -sV <targetIP> -oN nmap-enum-<targetIP>.txt
nmap --script=smb-os-discovery <targetIP> -oN nmap-smb-<targetIP>.txt
dirb https://localhost:3000 > dirb-juice.txt
5. SNMP Enumeration (if enabled)
snmpwalk -v1 -c public <targetIP> > snmp-<targetIP>.txt
6. Wireshark / tcpdump (Optional)
sudo tcpdump -i <iface> -w enum_capture.pcap
Or use Wireshark GUI, filter on smb || snmp || http
7. Evidence to collect
• nbtscan-<targetIP>.txt
• enum4linux-<targetIP>.txt
• smbshares-<targetIP>.txt
• nmap-enum-<targetIP>.txt
• nmap-smb-<targetIP>.txt
• dirb-juice.txt (if using Juice Shop)
• snmp-<targetIP>.txt (if applicable)
• enum_capture.pcap (optional)
• commands-log.txt
• 2-3 screenshots (nbtscan, enum4linux, dirb output)
8. Report (1 page)
Include:
• Header (name, student ID, date, target used)
• Short description of tools used
• Top 3 findings (Target | Evidence file | Short description | Risk | Recommendation)
• Answers to 6 short questions
9. Questions to answer in report
Q1: What did nbtscan reveal about the target system?
Q2: What user or share information did enum4linux or smbclient provide? No AI shortcuts — Get genuine assignment help from experienced, real tutors.
Q3: Which open services were confirmed by Nmap?
Q4: Did the directory enumeration reveal hidden resources?
Q5: What information did SNMP (if tested) expose?
Q6: Why is enumeration considered noisy compared to recon?