Scanning and Enumeration
We validate this area during scoped assessments, documenting impact and remediation guidance.
Why it matters
- [ ] Perform port scanning to identify open ports and services. - [ ] Enumerate commonly used ports (e.g., 135, 139, 445, 3389). - [ ] Check for unusual or custom ports. - [ ] Identify services running on target systems. - [ ] Enumerate service versions and vulnerabilities. - [ ] Pay attention to RPC, LDAP, SMB, and RDP services. - [ ] Enumerate users and groups. - [ ] Gather information about user attributes. - [ ] Check for locked or disabled accounts. - [ ] Identify high-privilege users and administrators. - [ ] Analyze password policies and complexity requirements. - [ ] Check for password lockout policies and expiration settings. - [ ] Look for password reuse vulnerabilities. - [ ] Enumerate Kerberos tickets and ticket-granting tickets (TGTs). - [ ] Check for Kerberoasting vulnerabilities. - [ ] Identify accounts with Kerberos pre-authentication disabled.
How we test it
Our operators follow a structured checklist for this topic, adapted to your API surface and authentication model.
Testing approach
- Structured validation of Scanning and Enumeration during scoped assessment.
- Evidence captured with reproducible steps for your engineering team.
What we look for
- Misconfigurations and control gaps related to Scanning and Enumeration.
- Exploitable paths that could affect confidentiality, integrity, or availability.
Engagement checklist
Items we validate during scoping and execution for this topic.
What we assess
- Perform port scanning to identify open ports and services.
- Enumerate commonly used ports (e.g., 135, 139, 445, 3389).
- Check for unusual or custom ports.
- Identify services running on target systems.
- Enumerate service versions and vulnerabilities.
- Pay attention to RPC, LDAP, SMB, and RDP services.
- Enumerate users and groups.
- Gather information about user attributes.
- Check for locked or disabled accounts.
- Identify high-privilege users and administrators.
- Analyze password policies and complexity requirements.
- Check for password lockout policies and expiration settings.
- Look for password reuse vulnerabilities.
- Enumerate Kerberos tickets and ticket-granting tickets (TGTs).
- Check for Kerberoasting vulnerabilities.
- Identify accounts with Kerberos pre-authentication disabled.
Related topics
| Topic | Summary |
|---|---|
| Active Directory (AD) - Basics Understanding | Within Active Directory, there are three built-in groups that comprise the highest privilege groups in the director |
| Active Directory (AD) Terminology | We validate this area during scoped assessments, documenting impact and remediation guidance. |
| DLL | A DLL (Dynamic Link Library) is a file format used in Microsoft Windows environments to contain code, data, and resources that can be used by multiple programs simultaneously. DLLs help modularize applications, allowing them to share common functions without duplicating code acr… |
| Extended Active Directory (AD) Terminology | We validate this area during scoped assessments, documenting impact and remediation guidance. |
| I. Active Directory Enumeration | We validate this area during scoped assessments, documenting impact and remediation guidance. |
| II. Local Privilege Escalation | We validate this area during scoped assessments, documenting impact and remediation guidance. |