Enumeration: digging into services

Scanning found the doors; enumeration looks inside

Scanning tells you which ports and services exist. Enumeration is the next, slower step: asking each service for more detail. For a web server that might mean listing pages and folders; for a file-sharing service, listing the shares; for a login service, learning the username format. The goal is a precise map of what is there.

Common things testers enumerate

Web directory enumeration (example)

A common web step is to look for folders and files that are not linked anywhere, such as /admin or /backup. Tools do this by trying names from a wordlist and noting which return a page. Against your own lab this is fine; against a client it must be in the rules of engagement, because it is noisy.

# Against an authorised lab target only:
gobuster dir -u http://192.168.56.102/ -w /usr/share/wordlists/dirb/common.txt
# Lists folders/files that exist, like /admin or /uploads

Detection and defence

Detection: enumeration is noisier than scanning — many requests, lots of 404 "not found" responses, odd paths. Web logs, IDS and a SIEM pick this up quickly. Defence: do not expose admin pages publicly, require authentication, return consistent responses so valid and invalid names look the same (so attackers cannot tell which usernames exist), turn off risky features like DNS zone transfers, and change default SNMP strings. Each defence removes a clue.