/enumerate

description: Network service enumeration — SMB, RPC, NetBIOS, LDAP
allowed-tools: ToolSearch, Bash, Read, Write
argument-hint: <target-ip>

> **Storage Policy**: ALL output files MUST be saved in the project directory. NEVER write to `/tmp/` or any system temporary directory.

Network Service Enumeration

Target: `$ARGUMENTS`

Enumerate network services on the target using Hexstrike MCP tools.

Step 1: Load Tools

Use ToolSearch to load:

• `enum4linux_ng_advanced` — comprehensive SMB/RPC enumeration
• `smbmap_scan` — SMB share enumeration and access testing
• `rpcclient_enumeration` — RPC service enumeration
• `nbtscan_netbios` — NetBIOS name scanning
• `netexec_scan` — multi-protocol network enumeration

Step 2: NetBIOS Discovery

Run `nbtscan_netbios` to discover NetBIOS names, workgroups, and MAC addresses on the target or subnet.

Step 3: SMB Enumeration

Run `enum4linux_ng_advanced` for comprehensive enumeration:

• Users, groups, shares, policies
• OS information
• Domain/workgroup info
• RID cycling for user enumeration

Then run `smbmap_scan` to check:

• Share permissions (read/write/execute)
• Accessible files in shares
• Null session access

Step 4: RPC Enumeration

Run `rpcclient_enumeration` for:

• Domain user listing
• Domain group listing
• Share enumeration
• Server info
• Password policy

Step 5: Multi-Protocol Check

Run `netexec_scan` across protocols (SMB, SSH, WinRM, LDAP, MSSQL) to:

• Check for default/null credentials
• Identify accessible services
• Map the network attack surface

Step 6: Results

Save findings to `enumerate-{target}.md` in the project directory, organized by:

• Users discovered
• Shares and their permissions
• Domain/network information
• Credential-related findings
• Recommended next steps (privilege escalation paths, lateral movement)