Enumeration Checklist

✅ Enumeration Checklist — run these first

The opening routine for every new box

Enumerate hard before you exploit. Most “stuck” moments are missed enumeration.

1. Full port scan

nmap -p- --min-rate 10000 -T4 -Pn IP -oN nmap.allports.txt     # find every open port
nmap -sC -sV -p <open,ports> -T4 IP -oN nmap.tcp.txt           # service/version + default scripts
nmap -sU -T4 --top-ports=100 IP                                # top UDP

Details & flag reference: Nmap. Don’t trust the default top-1000 scan.

2. Enumerate every service you found

One file per port in 03-services/:

• 21 → 21-ftp
• 22 → 22-ssh
• 25/143 → 25-143-smtp-imap
• 80/443 → 80-443-http
• 139/445 → 139-445-smb
• 161 → 161-snmp
• 389 → 389-ldap
• 3306 → 3306-mysql
• 5432 → 5432-postgres
• 88 → kerberos

3. Web present? (80/443/8080/…)

whatweb http://IP                          # tech stack
gobuster dir -u http://IP -w <wordlist> -x php,html,txt

Then read robots.txt, sitemap.xml, page source & JS, and the Network tab.
Full web recon: Web-enum.

4. Note everything

• Usernames, versions, hostnames, domain/TLD (.local), email addresses, interesting paths.
• Reuse usernames AND passwords across services.

5. Decide an attack path

• Web bug? → 04-web/ (sqli, lfi-traversal, file-upload, …)
• Known service version? → exploitation (searchsploit)
• Creds found? → try everywhere (password-attacks), then shell → Shell-stabilization
• Got a shell? → privesc (linux / windows)

If this routine turns up nothing, go to When-stuck.