/infrastructure-enumeration

name: infrastructure-enumeration
description: >
  Enumeration of infrastructure services: DNS, SMTP, SNMP, IPMI, NFS,
  TFTP, RPC/MSRPC, and HTTP/HTTPS surface detection. Checks zone
  transfers, open relays, default community strings, cipher zero, NFS
  exports, and web technology fingerprinting. Use after network-recon
  identifies infrastructure ports.
keywords:
  - DNS zone transfer
  - SMTP relay
  - SNMP community string
  - IPMI cipher zero
  - NFS no_root_squash
  - TFTP
  - RPC null session
  - HTTP tech detect
  - snmpwalk
  - onesixtyone
  - showmount
tools:
  - nmap
  - snmpwalk
  - onesixtyone
  - dnsrecon
  - smtp-user-enum
  - httpx
opsec: medium

Infrastructure Enumeration

You are helping a penetration tester enumerate infrastructure services on discovered hosts. All testing is under explicit written authorization.

Engagement Logging

Check for `./engagement/` directory. If absent, proceed without logging. When present:

• Print `[infrastructure-enumeration] Activated → <target>` on activation.
• Save significant output to `engagement/evidence/` with descriptive filenames

(e.g., `dns-zone-transfer-10.10.10.5.txt`, `snmp-walk-10.10.10.20.txt`).

Scope Boundary

This skill covers **infrastructure service enumeration only** — misconfigs, default credentials, and info disclosure on non-web, non-AD services, plus surface-level HTTP/HTTPS tech detection.

**Out of scope — route instead:**

• Deep web application testing
• Kerberos/LDAP/domain enumeration
• Credential brute force
• Exploitation of discovered vulns → return to orchestrator

Do not load or execute another skill. Stay in methodology.

State Management

Call `get_state_summary()` to read current engagement state. Use it to:

• Skip services already enumerated
• Leverage existing credentials (e.g., SNMP community strings already found)
• Check Blocked section for previous failures

**State writes** — write critical discoveries immediately:

• SNMP community string → `add_credential(username="", secret="<community>", secret_type="other", source="SNMP on <host>")`
• SNMP network interfaces revealing subnets → `add_pivot(source="SNMP on <host>", destination="<subnet>", method="SNMP interface enumeration")`
• LDAP signing not required → `add_vuln(title="LDAP signing not required on <host>", host="<host>", vuln_type="ldap-signing", severity="medium")`
• LDAP anonymous bind → `add_vuln(title="LDAP anonymous bind on <host>", host="<host>", vuln_type="null-session", severity="medium")`
• Domain name from rootDSE/LDAP → `add_pivot(source="LDAP rootDSE on <host>", destination="<domain>", method="LDAP enumeration")`
• NFS no_root_squash → `add_vuln(title="NFS no_root_squash on <host>:<share>", host="<host>", vuln_type="nfs-misconfig", severity="high")`
• IPMI cipher 0 → `add_vuln(title="IPMI cipher zero on <host>", host="<host>", vuln_type="ipmi-cipher-zero", severity="critical")`
• DNS zone transfer → `add_vuln(title="DNS zone transfer on <host>", host="<host>", vuln_type="zone-transfer", severity="medium")`
• SMTP open relay → `add_vuln(title="SMTP open relay on <host>", host="<host>", vuln_type="open-relay", severity="high")`

Report all findings in your return summary.

Prerequisites

• Network access to target host(s)
• Port list from orchestrator or network-recon (open TCP/UDP ports)
• For SNMP/IPMI/TFTP: UDP scan results (UDP-only services)

**Only run sections for ports that are actually open.** Skip sections entirely if the relevant ports are not open — do not scan for ports yourself.

DNS — Port 53

nmap -sV -p53 --script dns-zone-transfer,dns-cache-snoop,dns-nsid TARGET_IP

# Zone transfer (requires domain name — check state or reverse DNS)
dig axfr @TARGET_IP target.com
host -l target.com TARGET_IP

# Reverse DNS sweep (discover hostnames on the subnet)
dnsrecon -r 10.10.10.0/24 -n TARGET_IP

# Subdomain brute force
dnsenum --dnsserver TARGET_IP --enum target.com \
  -f /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

**Quick wins:** Zone transfer (full DNS dump), wildcard records, internal hostnames revealing naming conventions and services.

SMTP — Ports 25/465/587

nmap -sV -p25,465,587 --script smtp-commands,smtp-enum-users,smtp-open-relay,smtp-vuln* TARGET_IP

# User enumeration via VRFY/RCPT/EXPN
smtp-user-enum -M VRFY -U users.txt -t TARGET_IP
smtp-user-enum -M RCPT -U users.txt -t TARGET_IP
smtp-user-enum -M EXPN -U users.txt -t TARGET_IP

**Quick wins:** Open relay (send mail as anyone), user enumeration (valid accounts), NTLM auth info leak (`MAIL FROM:<> AUTH NTLM` reveals internal hostname/domain).

RPC/MSRPC — Ports 111/135

# Linux RPC (port 111)
rpcinfo -p TARGET_IP
showmount -e TARGET_IP  # NFS preview

# Windows MSRPC (port 135)
rpcclient -U "" -N TARGET_IP
rpcclient -U "" -N TARGET_IP -c "enumdomusers;enumdomgroups;getdompwinfo"
rpcdump.py TARGET_IP | grep -E "Protocol|Provider"

**Quick wins:** Null session user enumeration, NFS shares via rpcinfo, MSRPC endpoint map revealing internal services.

LDAP — Ports 389/636/3268

# rootDSE query (always allowed per RFC)
ldapsearch -x -H ldap://TARGET_IP -b "" -s base namingContexts

# Anonymous directory read
ldapsearch -x -H ldap://TARGET_IP -b "DC=domain,DC=local" \
  "(objectClass=user)" sAMAccountName description memberOf

nmap -sV -p389,636,3268 --script ldap-rootdse,ldap-search TARGET_IP

**Quick wins:** Anonymous bind, password in description, rootDSE domain disclosure, LDAP signing not required.

→ STOP and return with: what was achieved, new findings, context for next steps. domain name from rootDSE, anonymous bind results.

Kerberos — Port 88

DO NOT enumerate. Kerberos enumeration and ticket requests belong to AD skills.

→ STOP and return with: what was achieved, new findings, context for next steps. domain name, any credentials found.

HTTP/HTTPS — Ports 80/443/8080/8443

# HTTP enumeration
nmap -sV -p80,443,8080,8443 \
  --scrip