2.5 Enumeration

EC-Council Certified Ethical Hacker CEH

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 CEH Exam Format, Cost & Eligibility 1.2 The Five Phases of Ethical Hacking 1.3 Information Security Fundamentals 1.4 Ethical Hacking Concepts, Scope & Legal Framework 1.5 The CEH Domains & Your Study Priority Map

2 Reconnaissance, Footprinting, Scanning & Enumeration

2.1 Footprinting & Reconnaissance Concepts 2.2 Footprinting Sources & Techniques 2.3 Network Scanning Concepts 2.4 Banner Grabbing, OS Fingerprinting & Scanning Beyond IDS/Firewall 2.5 Enumeration 2.6 Vulnerability Scanning & Countermeasures

3 Vulnerability Analysis & System Hacking Phases

3.1 Vulnerability Analysis Concepts 3.2 System Hacking Methodology Overview 3.3 Gaining Access: Password Attack Concepts 3.4 Privilege Escalation Concepts 3.5 Maintaining Access: Backdoors, Rootkits & Persistence 3.6 Covering Tracks, Anti-Forensics & Blue-Team Detection

4 Malware Threats, Sniffing & Social Engineering

4.1 Malware Concepts and Taxonomy 4.2 Malware Analysis and Detection 4.3 Sniffing Concepts and Layer 2 Attacks 4.4 Sniffing Countermeasures and Detection 4.5 Social Engineering Types and Human Psychology 4.6 Social Engineering and Insider Threat Defenses

5 Network & Perimeter Hacking

5.1 Denial of Service and DDoS Attacks 5.2 Session Hijacking 5.3 Evading IDS and IPS (Defensive Focus) 5.4 Evading Firewalls 5.5 Evading Honeypots and Defensive Deception 5.6 Network Security Controls and Architecture 5.7 Packet Analysis and Secure Protocols for Defenders

6 Web Server & Web Application Hacking

6.1 Web Server Attacks & Hardening 6.2 OWASP Top 10 Overview 6.3 Injection: SQL Injection & Command Injection 6.4 Cross-Site Scripting (XSS) & CSRF 6.5 Authentication, Session & Access-Control Flaws 6.6 API & Web App Security Testing Concepts

7 Wireless Network Hacking

7.1 Wireless Concepts and Standards 7.2 Wireless Encryption 7.3 Wireless Threats and Attack Concepts 7.4 Wireless Security Countermeasures

8 Mobile Platform, IoT & OT Hacking

8.1 Mobile Platform Threats & Security Models 8.2 Mobile Attack Vectors & Risks 8.3 Mobile Device Management & Enterprise Defense 8.4 IoT Hacking Concepts & Defense 8.5 OT, ICS & SCADA Security

9 Cloud Computing & Cryptography

9.1 Cloud Computing Concepts 9.2 Cloud Threats & Attack Surfaces 9.3 Cloud Security Controls 9.4 Cryptography Fundamentals 9.5 PKI & Cryptographic Applications 9.6 Cryptanalysis, Crypto Attacks & Best Practices

Key Takeaways Explain This Topic AI

Enumeration actively extracts named resources — user accounts, shares, services, and configuration — from services already discovered by scanning, creating direct connections that are logged

NetBIOS (UDP 137/138, TCP 139) and SMB (TCP 445) enumeration can expose share names, user lists, OS details, and null-session data on legacy or misconfigured Windows hosts

SNMP (UDP 161/162) enumeration with default community strings — read 'public', write 'private' — can dump interfaces, routes, ARP tables, and running processes via the MIB

LDAP (389/636) reveals Active Directory users/groups/OUs; SMTP (25) VRFY/EXPN/RCPT TO confirm valid mailboxes; DNS zone transfer (AXFR over TCP 53) can dump the zone; NTP (123) leaks hosts/clients

Countermeasures: disable unneeded services (NetBIOS/null sessions), change default SNMP community strings or move to SNMPv3, restrict zone transfers and LDAP anonymous binds, and disable SMTP VRFY/EXPN

Last updated: June 2026

What Enumeration Is

Enumeration is the active extraction of named resources — user accounts, group memberships, shares, services, routing tables, and configuration — from services that scanning already found. Where scanning answers "which ports are open?", enumeration answers " who and what is behind them?". It establishes direct, authenticated-or-unauthenticated connections to services and issues directed queries, so it is firmly active and logged .

Enumeration is high value because it converts a generic open port into concrete attack inputs: a confirmed username list feeds password-spraying, a writable share feeds lateral movement, an SNMP dump hands over the network topology. The exam ties each enumeration technique to its protocol and port , so anchor your study on the protocol/port pairings below.

Keep the phase boundaries straight, because CEH tests them: scanning finds open ports, banner grabbing/version detection names the software, and enumeration extracts the named resources inside those services. Enumeration is the bridge from "port 445 is open" to "the host has a Backups$ share and a svc_sql service account." Everything below assumes you are authorised — the same queries a blue team runs to audit exposure are what an attacker runs to weaponise it.

NetBIOS, SMB, and SNMP

NetBIOS enumeration targets the legacy Windows naming service on UDP 137 (name), UDP 138 (datagram), TCP 139 (session) . Tools like nbtstat -A <ip> and nbtscan return the NetBIOS name table — computer name, workgroup/domain, logged-on user, and services — and a NetBIOS suffix (e.g. <20> = file-sharing service).

SMB enumeration over TCP 445 (modern SMB) and 139 lists shares, users, OS version, and password policy. The historic risk is the null session — an unauthenticated IPC$ connection ( net use \\target\IPC$ "" /u:"" ) that older Windows allowed, leaking user and share lists. Tools: enum4linux , smbclient , rpcclient .

SNMP enumeration uses UDP 161 (queries), 162 (traps) to read a device's MIB (Management Information Base) . The fatal default is the community string : read-only public and read-write private . With a valid string, snmpwalk / snmp-check dump interfaces, routes, ARP and TCP tables, running processes, installed software, and user accounts. SNMPv1/v2c send these strings in cleartext; SNMPv3 adds authentication and encryption.

Protocol Port(s) Tools Exposes
NetBIOS UDP 137/138, TCP 139 nbtstat, nbtscan Names, workgroup, logged-on user
SMB TCP 445, 139 enum4linux, smbclient, rpcclient Shares, users, OS, null-session data
SNMP UDP 161/162 snmpwalk, snmp-check Interfaces, routes, processes, accounts

LDAP, SMTP, DNS, NTP, and the Countermeasures

LDAP enumeration queries directory services — especially Active Directory — on TCP/UDP 389 (LDAP) and 636 (LDAPS). Anonymous or weakly authenticated binds via ldapsearch or tools like ldapdomaindump reveal users, groups, organisational units (OUs), and policies — a goldmine for AD attacks. The Global Catalog adds TCP 3268/3269 , and tools such as enum4linux , BloodHound (collected via SharpHound), and PowerView turn raw directory data into attack-path graphs.

Related Windows services: RPC on TCP 135 and the RPC endpoint mapper are common enumeration footholds, and MSRPC over SMB underpins much of the user/share listing.

SMTP enumeration abuses three mail commands on TCP 25 to confirm valid users before phishing or spraying:

VRFY — verify a username exists.

EXPN — expand a mailing list to its members.

RCPT TO — accept/reject reveals whether a mailbox exists.

DNS enumeration over port 53 includes the zone transfer (AXFR over TCP 53) , which on a misconfigured server dumps every record in the zone, plus subdomain brute-forcing. NTP enumeration on UDP 123 ( ntpdc , ntpq monlist ) can leak the list of hosts/clients that synced with a server, exposing internal IPs.

Countermeasures table

Vector Countermeasure
NetBIOS/SMB Disable NetBIOS over TCP/IP and null sessions; restrict SMB; RestrictAnonymous
SNMP Change default community strings; remove public / private ; use SNMPv3 ; filter UDP 161
LDAP Disable anonymous binds; require LDAPS/TLS; least-privilege directory ACLs
SMTP Disable VRFY/EXPN ; ignore RCPT differences; rate-limit
DNS Restrict AXFR to authorised secondaries; split-horizon DNS
NTP Disable monlist ; restrict NTP queries; patch

The unifying defensive principle across all of these: disable services you do not need, replace every default credential/community string, and restrict verbose or anonymous responses — that single posture cuts exposure across NetBIOS, SMB, SNMP, LDAP, and SMTP at once.

Three more enumeration vectors round out the CEH module. IPsec enumeration probes VPN gateways on UDP 500 (IKE) to fingerprint the VPN and its supported transforms. VoIP enumeration targets SIP on UDP/TCP 5060/5061 , where banner and extension scanning reveals the PBX, firmware, and valid extensions for toll-fraud or eavesdropping. RPC/SMB enumeration via the endpoint mapper on TCP 135 lists the dynamic ports of running services.

Across every vector the detective control is the same: any unauthenticated query that returns a list of internal resources is enumeration in progress, and a default-deny posture plus authenticated-only directory/management access shrinks what those queries can ever return. For the exam, pair each protocol with both its port and the one countermeasure that most directly neutralises it — that mapping is the highest-yield thing to memorise in this section.