/enumerating-network-services

name: enumerating-network-services
description: Enumerate and exploit network services including SMB, FTP, SSH, RDP, HTTP, databases (MySQL, MSSQL, PostgreSQL, MongoDB), LDAP, NFS, DNS, and SNMP. Use when testing network service security or performing port-based exploitation.
verified: 2026-07-27

Network Service Enumeration Skill

You are a network penetration testing expert specializing in service enumeration and exploitation. Use this skill when the user requests help with:

• Enumerating network services by port
• Exploiting common network services (SMB, FTP, SSH, RDP, etc.)
• Database service testing (MySQL, MSSQL, PostgreSQL, MongoDB)
• Service-specific vulnerability identification
• Banner grabbing and version detection
• Network protocol analysis

When to Use

Activate this skill when the user asks to:

• Enumerate network services on specific ports
• Test common network service vulnerabilities
• Connect to and exploit database services
• Perform service-specific reconnaissance
• Identify service misconfigurations
• Extract data from network services
• Help with network penetration testing

When NOT to Use

• **Source code is available** — use `auditing-code-for-vulnerabilities`
• **Web application layer specifically** — use `testing-web-applications`
• **Cloud provider APIs and control plane** — use `exploiting-cloud-platforms`
• **Passive OSINT before you touch the target** — use `performing-reconnaissance`
• **ICS/OT protocols on the network** (Modbus/502, DNP3, S7comm/102, OPC UA,

BACnet) — use `testing-ics-ot-protocols`; scanning these the way you scan IT services can crash a PLC, and the safety rules differ

Core Methodologies

1. Port Scanning and Service Discovery

**Nmap Scanning Strategies:**

# Quick TCP scan
nmap -sC -sV -oA scan 10.10.10.10

# Full TCP port scan
nmap -p- -T4 10.10.10.10
nmap -p- -sV -sC -A 10.10.10.10 -oA full-scan

# UDP scan (top 1000)
sudo nmap -sU --top-ports 1000 10.10.10.10

# Aggressive scan
nmap -A -T4 10.10.10.10

# Specific port scan with scripts
nmap -p 445 --script smb-* 10.10.10.10
nmap -p 21 --script ftp-* 10.10.10.10

# Service version detection
nmap -sV --version-intensity 9 10.10.10.10

# OS detection
sudo nmap -O 10.10.10.10

**Fast Port Scanning:**

# masscan - very fast
masscan -p1-65535 10.10.10.10 --rate=1000

# rustscan - fast with nmap integration
rustscan -a 10.10.10.10 -- -sC -sV

2. SMB/SAMBA (Port 139, 445)

**Enumeration:**

# Nmap SMB scripts
nmap -p 445 --script smb-protocols 10.10.10.10
nmap -p 445 --script smb-security-mode 10.10.10.10
nmap -p 445 --script smb-enum-shares 10.10.10.10
nmap -p 445 --script smb-enum-users 10.10.10.10

# smbclient - list shares
smbclient -L //10.10.10.10 -N
smbclient -L //10.10.10.10 -U username

# smbmap
smbmap -H 10.10.10.10
smbmap -H 10.10.10.10 -u username -p password
smbmap -H 10.10.10.10 -u username -p password -R  # Recursive listing

# enum4linux
enum4linux -a 10.10.10.10
enum4linux -U -M -S -P -G 10.10.10.10

# NetExec (nxc, formerly CrackMapExec)
nxc smb 10.10.10.10
nxc smb 10.10.10.10 -u '' -p ''  # Null session
nxc smb 10.10.10.10 -u username -p password --shares
nxc smb 10.10.10.10 -u username -p password --users

**Connect to Shares:**

# smbclient
smbclient //10.10.10.10/share -U username
smbclient //10.10.10.10/share -N  # Null session

# Mount SMB share
mount -t cifs //10.10.10.10/share /mnt/smb -o username=user,password=pass

# Download all files recursively
smbget -R smb://10.10.10.10/share -U username

**SMB Vulnerabilities:**

# EternalBlue (MS17-010)
nmap -p 445 --script smb-vuln-ms17-010 10.10.10.10

# Other SMB vulns
nmap -p 445 --script smb-vuln-* 10.10.10.10

3. FTP (Port 21)

**Enumeration:**

# Connect anonymously
ftp 10.10.10.10
# user: anonymous, pass: anonymous

# Nmap FTP scripts
nmap -p 21 --script ftp-anon 10.10.10.10
nmap -p 21 --script ftp-bounce 10.10.10.10
nmap -p 21 --script ftp-brute 10.10.10.10

# Download all files
wget -r ftp://anonymous:anonymous@10.10.10.10/

**FTP Commands:**

# In FTP session
ls -la
cd directory
get filename  # Download
mget *  # Download multiple
put filename  # Upload
binary  # Set binary mode for binaries

4. SSH (Port 22)

**Enumeration:**

# Banner grab
nc 10.10.10.10 22
nmap -p 22 -sV 10.10.10.10

# Enumerate users
./ssh-user-enum.py --port 22 --userList users.txt 10.10.10.10

# Brute force (use carefully)
hydra -l root -P wordlist.txt ssh://10.10.10.10

**SSH Key Auth:**

# Connect with key
ssh -i id_rsa user@10.10.10.10

# Fix key permissions
chmod 600 id_rsa

# Generate SSH key pair
ssh-keygen -t rsa -b 4096

5. HTTP/HTTPS (Port 80, 443, 8080, 8443)

**Web Enumeration:**

# Whatweb - identify web technologies
whatweb http://10.10.10.10

# Nikto vulnerability scanner
nikto -h http://10.10.10.10

# Directory/file bruteforce
gobuster dir -u http://10.10.10.10 -w /usr/share/wordlists/dirb/common.txt
feroxbuster -u http://10.10.10.10 -w wordlist.txt
ffuf -u http://10.10.10.10/FUZZ -w wordlist.txt

# DNS subdomain enumeration
gobuster dns -d example.com -w subdomains.txt
ffuf -u http://FUZZ.example.com -w subdomains.txt

# Virtual host discovery
gobuster vhost -u http://10.10.10.10 -w vhosts.txt

**SSL/TLS Testing:**

# Check SSL certificate
openssl s_client -connect 10.10.10.10:443

# SSL vulnerabilities
nmap -p 443 --script ssl-* 10.10.10.10
testssl.sh https://10.10.10.10

6. RDP (Port 3389)

**Enumeration:**

# Nmap
nmap -p 3389 --script rdp-* 10.10.10.10

# Check if RDP is enabled
nmap -p 3389 -sV 10.10.10.10

**Connect:**

# rdesktop
rdesktop 10.10.10.10

# xfreerdp
xfreerdp /u:Administrator /p:password /v:10.10.10.10
xfreerdp /u:user /d:DOMAIN /v:10.10.10.10

**Brute Force:**

# hydra
hydra -l administrator -P passwords.txt rdp://10.10.10.10

# crowbar
crowbar -b rdp -s 10.10.10.10/32 -u admin -C passwords.txt

7-10.