Study guide
6.2 DNS, Directory, Share, and Account Enumeration
CompTIA PenTest+ PT0-003
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current PT0-003 Exam Facts 1.2 Format, PBQs, Scoring, and Retake Policy 1.3 Recertification, CEUs, and Career Fit
2 Pre-Engagement Planning
2.1 Scope, Rules of Engagement, and Agreements 2.2 Target Selection and Assessment Types 2.3 Shared Responsibility, Legal Authorization, and Ethics
3 Collaboration, Frameworks, and Threat Modeling
3.1 Collaboration, Escalation, and Stakeholder Communication 3.2 Testing Frameworks and Methodologies 3.3 Threat Modeling: STRIDE, DREAD, and OCTAVE
4 Reporting and Remediation
4.1 Penetration Test Report Components 4.2 Findings Analysis and Remediation Recommendations
5 Information Gathering
5.1 Active vs Passive Reconnaissance 5.2 OSINT Sources and Techniques 5.3 DNS, Certificate Transparency, and Search Engine Enumeration 5.4 Network Recon, Protocol Scanning, Sniffing, and Banner Grabbing
6 Enumeration Techniques
6.1 OS Fingerprinting, Service Discovery, and Host Discovery 6.2 DNS, Directory, Share, and Account Enumeration 6.3 Secrets, Permissions, and Wireless Enumeration 6.4 WAF Enumeration, Web Crawling, and Attack Path Mapping
7 Recon Scripting and Tools
7.1 Modifying Bash, Python, and PowerShell for Recon 7.2 Recon and Enumeration Tools
8 Vulnerability Scan Types
8.1 Network, Host, Authenticated, and Wireless Scans 8.2 SAST, DAST, IAST, SCA, IaC, and Mobile Scans 8.3 Container, Secrets, and ICS Vulnerability Assessment 8.4 Core Vulnerability Scanners (Nessus, OpenVAS, Nikto)
9 Scan Analysis and Physical Security
9.1 Specialized Discovery Tools 9.2 Validating Scan, Recon, and Enumeration Results 9.3 Public Exploit Selection and Scripted Validation 9.4 Physical Security Concepts for PenTests
10 Attack Prioritization and Preparation
10.1 Target Prioritization: CVSS, CVE, CWE, and EPSS 10.2 Exploit Selection, Customization, and Attack Documentation
11 Network Attacks
11.1 On-Path, VLAN Hopping, Relay, and Multihomed Hosts 11.2 Default Credentials, Misconfigured Services, Packet Crafting, and Certificate Services
12 Authentication Attacks
12.1 Pass-the-Hash, Pass-the-Ticket, Pass-the-Token, and Kerberos Attacks 12.2 Password Attacks, MFA Fatigue, LDAP Injection, OIDC, and SAML
13 Host-Based Attacks
13.1 Privilege Escalation and Credential Dumping 13.2 Process Injection, Security Bypass, and Host Attack Tools
14 Web Application Attacks
14.1 SQL, Command, XSS, and SSTI Injection 14.2 CSRF, SSRF, Deserialization, IDOR, and Directory Traversal 14.3 LFI/RFI, Web Shells, API Abuse, JWT, and Session Hijacking
15 Cloud Attacks
15.1 IAM Misconfiguration, Metadata Service, and Exposed Storage 15.2 Container Escape, Supply Chain, and Cloud Attack Tools
16 Wireless and Social Engineering
16.1 Wireless Attacks and Tools 16.2 Phishing, Spearphishing, Whaling, Vishing, and Smishing 16.3 Physical Social Engineering and SE Tools
17 Specialized Systems
17.1 Mobile Attacks and AI Prompt/Model Attacks 17.2 OT/ICS, NFC, RFID, and Bluetooth Attacks
18 Attack Scripting and BAS
18.1 PowerShell, Python, and Bash Attack Automation 18.2 Breach and Attack Simulation (Caldera, Infection Monkey, Atomic Red Team)
19 Persistence
19.1 Scheduled Tasks, Services, Accounts, and Shells 19.2 C2, Backdoors, Rootkits, and Security-Control Tampering
20 Lateral Movement
20.1 Pivoting, Relays, and Additional Credential Capture 20.2 Remote Services: SMB, RDP, WinRM, WMI, SSH, and Others 20.3 Lateral Movement Tools and LOLbins
21 Exfiltration and Cleanup
21.1 Staging and Exfiltration 21.2 Cleanup, Restoration, and Artifact Preservation
6.2 DNS, Directory, Share, and Account Enumeration
Key Takeaways Explain This Topic AI
DNS enumeration on 2.2 goes beyond a single lookup: zone transfers, DNSSEC NSEC walking, extra record types (A, AAAA, MX, NS, TXT, SRV, PTR), and subdomain brute force.
Directory enumeration covers LDAP/Active Directory naming contexts and objects, and web directory listings or predictable application paths.
Share enumeration lists SMB and NFS exports and whether access is anonymous/guest versus authenticated; administrative shares such as IPC$ or C$ usually need credentials.
Local user enumeration collects account names and attributes (SAMR/RID-style queries, LDAP, or /etc/passwd if obtained); description fields are part of the inventory.
Email-account enumeration uses SMTP VRFY/EXPN/RCPT oracles, password-reset messages, and mailbox lists — it is not the same as a local SAMR user listing.
Last updated: August 2026
Once host, service, OS, and protocol facts exist, PT0-003 still expects you to enumerate names and access . Objective 2.2 lists DNS enumeration , directory enumeration , share enumeration , local user enumeration , and email account enumeration as separate techniques. They often run against the same Windows Server 2019 box you just fingerprinted, but they answer different questions. DNS tells you what else the organization named. Directories tell you how objects are organized. Shares tell you which folders a guest or an authenticated user can see. Accounts tell you who exists — locally, in the directory, or as a mailbox.
DNS enumeration is more than a lookup
Objective 2.1 already covers DNS lookups and reverse lookups as information gathering. DNS enumeration on 2.2 is the deeper pass: what else does this zone reveal? You collect record types, not a single A record. A and AAAA map names to IPv4 and IPv6. MX shows the mail path, often a different security domain than the website. NS and SOA identify who answers authoritatively. TXT holds Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) policy — and, on a bad day, leftover cloud-verification tokens. CNAME aliases can point at a vendor you did not think was in scope (still a lead, not automatic authorization). PTR reverse records name hosts that forward DNS never advertised. SRV records are gold in Microsoft shops: _ldap._tcp.dc._msdcs.example.com locates domain controllers without a port scan.
Two misconfigurations turn DNS from a lookup into a dump. A zone transfer (AXFR) against a name server that allows it returns the full zone — every name the administrator published. Zone walking uses DNS Security Extensions (DNSSEC) NSEC or NSEC3 records, which were meant to prove that a name does not exist, to walk from one name to the next. Subdomain brute force tries likely labels ( vpn , staging , dev , mail , origin ) against the zone. That is still enumeration of the naming system, not OSINT scraping of social media. Exam trap: stopping after www.example.com resolves. The 2.2 item wants the extra records, the transfer attempt, or the brute-force pass.
Directory enumeration: LDAP and web paths
Directory enumeration has two exam meanings, and stems use both. In an identity directory, you enumerate Lightweight Directory Access Protocol (LDAP) or Active Directory (AD) naming contexts, users, groups, computers, and organizational units. An anonymous or low-privilege bind that returns the default naming context is already a finding. Distinguished names, group membership, and service principal names (SPNs) are inventory at this stage — you are mapping what the directory contains , not yet forging tickets.
On a web server, directory enumeration means learning which paths exist: an enabled directory listing, leftover /backup/ , /admin/ , /server-status , or an application that exposes predictable folders. Directory brute-force tools belong with the later recon-tools chapter; here you need the decision : listing or guessing web directories is 2.2 directory enumeration, and it stays inside the named URL or host in the statement of work. Wandering onto a content delivery network origin because it appeared in HTML is not "directory enum" — it is a scope problem.
Share enumeration: SMB and NFS, guest versus authenticated
Share enumeration lists file exports and the access model. On SMB you ask: which shares exist, and can a null session or guest account see them without a real password? IPC$ is the inter-process pipe share used for named-pipe RPC; it often requires a login even when a data share does not. Administrative shares such as C$ and ADMIN$ are not "more SMB" — they are authenticated, high-value targets you record but do not browse past authorization. On Network File System (NFS) you enumerate exported paths and whether the export is world-readable or restricted by client address. Anonymous File Transfer Protocol (FTP) is the same idea on a different protocol: a list of folders a stranger can see.
Worked example: guest share IT-ARCHIVE
Return to 10.4.12.8 , Windows Server 2019, 445 open, signing not required. Share enumeration with no credentials lists a guest-accessible folder named IT-ARCHIVE while IPC$ still demands a login. That distinction is the finding. Guest-readable archives are where backup catalogs, old configuration exports, and forgotten credential files live. You have not opened a ransomware path. You have named a data store that later attack-path mapping will connect to a service account.
Local user enumeration
Local user enumeration collects account names and attributes on a host or in a domain. On Windows, testers use Security Account Manager Remote (SAMR) and related RPC calls, including relative identifier (RID) cycling as an identification technique: well-known RID 500 is the built-in Administrator, 501 is Guest, and incrementing RIDs reveals which accounts exist. That is name discovery, not a password attack. LDAP queries against AD return sAMAccountName , description, last logon, and group membership when the bind allows it. On Linux, /etc/passwd — if obtained from a misconfigured share, an over-broad NFS export, or another authorized file read — lists local users even when password hashes sit in /etc/shadow .
Description fields matter. Continuing the worked example, a user named backup_svc has a description that says it runs overnight restores from IT-ARCHIVE. That sentence is enumeration gold: it ties a service account to a guest-readable share. You record the name, the description, and the group membership if you have it. You do not treat the description as a license to guess passwords in a public chat, and you do not skip documentation because "it is only a description."
Email account enumeration
Email account enumeration asks which mailboxes exist, not which local RIDs exist. Classic SMTP oracles are VRFY , EXPN , and RCPT TO responses that differ for valid versus invalid recipients. Web applications leak the same fact through password-reset wording ("no such user" versus "if that account exists, we sent mail") and through login timing. Staff directories and harvested addresses are recon-adjacent; on 2.2, the exam still wants you to recognize an email-enum technique when the stem shows SMTP replies or a reset oracle. A SAMR listing of backup_svc with no @ mailbox is local user enumeration. A mail server that confirms j.smith@example.com is email-account enumeration. Do not collapse them.
Technique What you collect Typical source Exam trap
DNS enumeration Records, zone contents, extra hostnames AXFR, NSEC walk, SRV/TXT, subdomain brute Stopping after one A lookup
Directory enumeration LDAP objects or web paths Naming context, group list, /admin/ Treating a CDN path as in-scope
Share enumeration SMB/NFS exports and access level Guest IT-ARCHIVE versus authenticated IPC$ Calling a share name an OS fingerprint
Local user enumeration Account names and attributes SAMR/RID, LDAP, /etc/passwd Skipping description fields
Email-account enumeration Valid mailboxes SMTP VRFY/EXPN/RCPT, reset oracles Calling every username an email enum
Keep these five inventories separate on the exam even when one host produces all of them. The Windows file server can yield unsigned SMB, a guest share, a service account, and an MX record that points at a different mail farm. Each row in the table is a different 2.2 bullet and a different line in the notes you will later connect as a path.