TechKnowSurge

VideoSecurityFree

Network Discovery and Enumeration

Discovery and enumeration are the intelligence-gathering phases attackers use after gaining initial access to a network, mapping out devices, services, credentials, and defenses before expanding their foothold.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

After an attacker gains an initial foothold inside a network, the immediate priority shifts to understanding the environment well enough to expand that access. This phase is broadly referred to as discovery and enumeration, two terms that are closely related but carry distinct meanings. Discovery refers to identifying what exists on the network — devices, services, and systems — while enumeration means extracting detailed information such as user accounts, group memberships, file shares, and permission structures. Reconnaissance, a third overlapping term, typically describes the research conducted before initial access is achieved. Frameworks like MITRE ATT&CK draw explicit distinctions between these stages, though in practice the concepts often blend together depending on context. The scope of what an attacker seeks to enumerate is broad. Targets include open ports and running services, directory structures, local and domain user credentials, API keys, cloud access tokens, session tokens, and log data that might reveal system behavior or stored secrets. Network management protocols such as SNMP and Cisco Discovery Protocol can expose the topology and configuration of the infrastructure itself, giving an attacker a clearer picture of how systems are interconnected and where weaknesses may exist. Beyond mapping assets, discovery also means identifying the defenses that are in place. Firewalls, intrusion detection and prevention systems, web application firewalls, load balancers, antivirus software, and honeypots all represent obstacles or risks that must be accounted for before proceeding. Understanding which vulnerabilities remain unpatched on discovered systems further informs the attack strategy. Common tools used during this phase include Nmap, SuperScan, Hping, Scapy, Wireshark, and TCPDump, each serving different purposes in profiling the network and surfacing exploitable conditions.

What you'll learn

Distinguish between reconnaissance, discovery, and enumeration as defined within adversarial attack frameworks such as MITRE ATT&CK
Identify the categories of network information an attacker targets during post-compromise discovery, including devices, services, credentials, tokens, and defensive controls

What's covered

Discovery & Enumeration

Key Terms Defined
- Reconnaissance
  - Preliminary external research
- Discovery
  - Knowledge within network
- Enumeration
  - Detailed numbers and data
Pivoting Concept
- Leverage compromised machine
- Access additional systems
- Gain network persistence
What to Enumerate
- Devices and services
  - Open ports and services
- Files and permissions
  - File shares and metadata
- Users and credentials
  - Local and domain accounts
  - Passwords and API keys
- Tokens and secrets
  - Issuance and revocation scope
Defenses to Identify
- Firewalls and WAFs
- IDS and IPS systems
- Honeypots and honeynets
- Antivirus and anti-malware
Discovery Tools
- NMAP and SuperScan
- Wireshark and TCPDump
- Hping and Scapy

Key terms

Reconnaissance: The first phase of an attack in which an adversary gathers information about a target — such as open ports, employee names, and technology stacks — before launching an attack. Reconnaissance can be passive (using public sources) or active (directly probing the target).
Enumeration: The process of extracting detailed information about a target, such as counting users, groups, and network resources, going deeper than general reconnaissance.
Port Scanning: A technique used to discover open ports and services available on a networked device.
Intrusion Detection System: A system that monitors network or system activities for malicious behavior and generates alerts.
Intrusion Prevention System: A system that monitors network traffic and actively blocks detected threats in real time.
Honeypot: A decoy system or network designed to attract and detect attackers while logging their activity.
Firewall: A network security device that monitors and controls incoming and outgoing traffic based on predefined security rules.
Web Application Firewall: A firewall that filters and monitors HTTP traffic to and from a web application to prevent attacks.
Simple Network Management Protocol: A protocol used to monitor and manage network devices such as routers, switches, and servers.
Pivot: A post-compromise technique where an attacker uses access on one compromised machine to gain access to other systems within the same network.

Topics

Network Enumeration Network Discovery Mitre Att&ck Post Compromise Threat Intelligence Cybersecurity Reconnaissance

Transcript

Why we need discovery

When we hack into a network, we may not immediately know how to gain persistence on that network. That is, we might have to do some research and reconnaissance in order to understand what that network is like and how we would gain persistence on that network, how we're going to install other exploits on that network. We may have to do some sort of discovery, some sort of reconnaissance.

If we are an adversary and we've compromised a machine inside of the network, we want to gain some sort of persistence. If that persistence is just on this machine right here, then that's great, but we probably want to gain some persistence in other areas of the network. Not to mention, we want to start attacking other areas of the network. We call this pivoting. Pivoting is when you leverage your access on one machine and then you pivot to access another machine. So we're going to want to start getting our fingers in all sorts of systems on this network.

Of course, we have to discover what is on the network, and so that's where discovery comes into play: we're going to discover different items, different machines, different services on this network.

Reconnaissance, discovery and enumeration

One thing to understand is that there are a few terms that are very similar. Reconnaissance, which means preliminary research; discovery, which means gain knowledge about a system; and enumeration, which is gain detailed information. They're all about discovering or finding out or researching or looking into.

Reconnaissance generally, we say, comes at the beginning, when you're first finding your target. Discovery can happen within the network. And enumeration is when we get detailed information about the number of users that are on the network and the details of those users, and then the departments and the different shares, and more of the numbers. Think numbers with that. So it's a little more specific than the other two.

In some ways we can use these interchangeably, although there are some systems that differentiate, like our MITRE ATT&CK system differentiates the difference between reconnaissance and discovery. Whatever definition you feel like fits the scenario the best. Essentially, what we really want to do is just figure out what this network looks like, what's on that network, and find out details about this network.

What we enumerate

Some of the things that we're going to want to enumerate are what kind of devices are on this network, and what type of devices those are. What kind of services and ports are running on those devices? What kind of files and file shares are within this network, and what kind of data, what kind of file metadata there is, what kind of permissions are on those different files?

Maybe we're looking at some sort of directory enumeration, so looking at the users, groups and email accounts, whether it's local users and groups on a computer or maybe it's domain credentials, something that can access many different machines on there.

We're also going to be looking at any kind of secrets that are on this network. So maybe we can find some passwords that are on there, or some sort of other cloud access keys or API keys or session tokens. Or perhaps we can start looking through logs and discovering information from the log files.

And what kind of management protocols are running within the network? Do they have Cisco Discovery Protocol? Do they have SNMP running on there? Because then we can find out more information about the network and how the network is formed. And a lot of times we can find vulnerabilities within this network that we can leverage for whatever kind of attack we're trying to carry out.

Tokens are one of those things that gets us access into certain things. When you log into something, it might have some sort of token involved with it. So what kind of tokens are out there? What's the scoping of those tokens? How do they get issued, and how do they get revoked? We can discover those types of things and leverage it.

Discovering the defenses

Now, if this adversary is putting any type of time and effort into putting up defenses, we need to know about that. They probably are going to have something like a firewall, and understanding what kind of firewall that is, and maybe how to poke some holes into that firewall, might be something that we'd want to look into.

Certainly we would want to know if they have any kind of intrusion prevention or intrusion detection systems that we would need to evade and make sure that we don't get caught by. Or is there some sort of honeypot or honeynet on the network that we need to watch out for? Is there some sort of load balance detection on this network, so do we detect any kind of load balancers that are in operation, or web application firewalls, or antivirus and anti-malware? So what exists on this network that could cause problems for us?

Vulnerabilities and tools

As we start discovering what the devices on this network are and what types of devices these are, we can also start discovering if they've got vulnerabilities. So we want to be able to count or tally the details about vulnerabilities that we find on this network. For instance, maybe this is a web server and we find that whatever web services it's running has some known vulnerabilities to it. Have they patched the system, or is it open? Are these vulnerabilities open so that we can hack into them?

There are a lot of different tools that we can use for discovering what's on this network. Just to mention a few: maybe it's Nmap, maybe SuperScan, hping, Scapy, Wireshark, tcpdump. Those are just some of the different applications that we could use out there to discover what's on this network, and what kind of vulnerabilities and what type of things we can find on this network.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →