Enumeration

ABOUT

In any situation, whether daily life or a network penetration test, understanding our surroundings is crucial. This awareness allows us to make informed, proactive decisions. We may discover accessible hosts, protections to bypass, or tools incompatible with the target system.

This is basically enumeration section, but most of it is about Living Off The Land enumeration, which is more stealthy and uses built-in tools. If there are command which requires not built in tool, I'll write about it. If you are inside domain environment, look for LOL subsections in Enum Section [LINK]

Data Sources

• Installed applications

• Installed services

  • Websites

  • File Shares

  • Databases

  • Directory Services (such as Active Directory, Azure AD, etc.)

  • Name Servers

  • Deployment Services

  • Certificate Authority

  • Source Code Management Server

  • Virtualization

  • Messaging

  • Monitoring and Logging Systems

  • Backups

• Sensitive Data

  • Keylogging

  • Screen Capture

  • Network Traffic Capture

  • Previous Audit reports

• User Information

  • History files, interesting documents (.doc/x,.xls/x,password./pass., etc)

  • Roles and Privileges

  • Web Browsers

  • IM Clients

NAMED PIPES

Listing Named Pipes

C:\> pipelist.exe /accepteula

PS C:\> gci \\.\pipe\

Reviewing LSASS Named Pipe Permissions

C:\> accesschk.exe /accepteula \\.\Pipe\lsass -v

SCHEDULED TASKS

C:\> schtasks /query /fo LIST /v

PS C:\> Get-ScheduledTask | select TaskName,State