Offensive methodology
Reconnaissance and enumeration
The first phase of a penetration test: map the target, find the exposed services and link each version to known weaknesses. Practise only within an authorised scope (private lab, HTB machines).
The process
- PassiveOSINT, public DNS, certificates: no packet to the target.
- DiscoveryLive hosts, open ports, services and versions.
- EnumerationDig into each service: shares, users, directories.
- MappingLink versions and configurations to known vulnerabilities.
Golden ruleEnumeration is 80% of the work. A missed foothold almost always comes from a service or version you did not see. Re-scan after every new access, from the new vantage point.
Passive reconnaissance
- WHOIS, DNS: domain owner, name servers, A, MX, TXT records.
- Subdomains: public certificates (crt.sh), search engines, wordlists.
- OSINT: credential leaks, code repositories, document metadata, public profiles.
- Technology fingerprint: HTTP headers, Wappalyzer, favicon, error messages.
Scanning with Nmap
| Command | Role |
|---|---|
| nmap -sn 10.10.10.0/24 | Host discovery, no port scan |
| nmap -p- --min-rate 1000 cible | All TCP ports, quickly |
| nmap -sC -sV -p … cible | Default scripts and versions on the found ports |
| nmap -sU --top-ports 100 cible | Main UDP ports (DNS, SNMP, TFTP…) |
| nmap -Pn cible | Treat the host as up (ICMP filtered) |
| nmap -oA scan cible | Save in the three formats |
Approach: a fast scan of all ports, then a targeted -sC -sV scan on the open ports. States: open, closed, filtered. See also the Ports and services sheet.
Enumeration by service
| Service | What to look for |
|---|---|
| Web (80/443) | Technologies, hidden directories and files, virtual hosts, robots.txt, login pages |
| SMB (139/445) | Shares and anonymous access, users, password policy |
| DNS (53) | Zone transfer, subdomains, internal records |
| FTP (21) | Anonymous login, readable or writable files |
| SNMP (161/udp) | Default community strings, system inventory |
| LDAP (389) | Directory objects, users, groups, without authentication |
Web content discoveryFuzzing of directories and files (ffuf, gobuster), virtual hosts (Host header) and parameters. A good wordlist changes everything: SecLists is the reference.
Linking to vulnerabilities
- For each version found: look up known CVEs (searchsploit, NVD) and public exploits.
- Look for the product's default credentials.
- Note everything: service, version, URL, credential found — the evidence will feed the report.
Defensive side
- A port scan shows up in firewall logs: many SYN, mostly RST, within seconds.
- Reduce the exposed surface, hide version banners, monitor DNS zone transfers.
- Detection: see Network Traffic Analysis.