Network Scanning and Enumeration for Ethical Hacking (OSCP Focus)
by

A Comprehensive Guide to Finding Every Attack Surface

Network scanning and enumeration are the foundation of penetration testing. In the OSCP exam, missing a single port or service can cost you the entire machine. This guide covers proven techniques to ensure you don’t overlook anything.

🔍 Phase 1: Host Discovery (Finding Live Hosts)

Before attacking, identify which hosts are alive in the target network.

1. Ping Sweep (Basic Detection)

for ip in $(seq 1 254); do ping -c 1 192.168.1.$ip | grep "bytes from" | cut -d " " -f 4 | cut -d ":" -f 1 & done
  • Alternative: nmap -sn 192.168.1.0/24 (ICMP ping sweep).
  • If ICMP is blocked: Use -Pn (treat all hosts as live).

2. ARP Scanning (Local Networks)

sudo arp-scan -l
  • Works even if ICMP is disabled.
  • Alternative: netdiscover -i eth0 -r 192.168.1.0/24.

3. Masscan (Ultra-Fast Scanning)

sudo masscan -p1-65535 192.168.1.0/24 --rate=1000 -e eth0
  • Best for large networks (scans all ports in seconds).

📡 Phase 2: Port Scanning (Finding Open Services)

Once hosts are found, identify open ports & services.

1. Basic Nmap Scan

nmap -sV -sC -oA initial_scan 192.168.1.100
  • -sV → Service detection.
  • -sC → Default Nmap scripts.
  • -oA → Saves output in 3 formats (XML, normal, grepable).

2. Aggressive Scan (OS & Version Detection)

nmap -A -T4 -p- 192.168.1.100
  • -A → Enables OS detection, version detection, and script scanning.
  • -p- → Scans all 65,535 ports.

3. UDP Scanning (Often Missed!)

sudo nmap -sU -p 53,67,68,69,123,161 192.168.1.100
  • Key UDP ports:
  • 53 (DNS)
  • 161 (SNMP)
  • 69 (TFTP)

4. Stealthy Scanning (Avoiding Detection)

sudo nmap -sS -Pn -n --disable-arp-ping -T2 192.168.1.100
  • -sS → SYN scan (half-open, stealthier).
  • -T2 → Slower (less likely to trigger alarms).

📂 Phase 3: Service Enumeration (Deep Dive)

Now, extract maximum info from each open port.

1. SMB (Windows Shares)

smbclient -L //192.168.1.100 -N
enum4linux -a 192.168.1.100
  • Check for:
  • Guest access (-N tries null session).
  • Sensitive files (*.txt, backup.zip).

2. HTTP/HTTPS (Web Apps)

gobuster dir -u http://192.168.1.100 -w /usr/share/wordlists/dirb/common.txt -x php,html,txt
nikto -h http://192.168.1.100
  • Check for:
  • Hidden directories (/admin, /backup).
  • Default creds (admin:admin).

3. FTP (File Transfer)

ftp 192.168.1.100
anonymous
  • Try anonymous login.
  • Check for: passwords.txt, config.php.

4. SSH (Secure Shell)

nmap -sV -p 22 --script=ssh-auth-methods 192.168.1.100
hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.100
  • Brute-force only if allowed (OSCP rules).

5. SNMP (Network Devices)

snmpwalk -c public -v1 192.168.1.100
  • Look for:
  • Running processes (hrSWRunTable).
  • Usernames (hrSWRunPerfTable).

6. RDP (Remote Desktop)

nmap -p 3389 --script=rdp-enum-encryption 192.168.1.100
xfreerdp /u:admin /v:192.168.1.100
  • Check for weak credentials.

🔥 Bonus: Automated Enumeration Tools

1. AutoRecon (OSCP Favorite)

autorecon 192.168.1.100
  • Runs multiple scans (TCP, UDP, web, SMB, etc.) automatically.

2. Recon-ng (Web Recon)

recon-ng
marketplace install all
workspaces add oscp_target
  • Gathers WHOIS, subdomains, emails.

3. Metasploit (For Quick Checks)

msfconsole
use auxiliary/scanner/portscan/tcp
set RHOSTS 192.168.1.100
run
  • Useful for quick service checks.

📝 OSCP Exam Tips

✔ Document everything (even failed attempts).
✔ Prioritize high-value ports (80, 443, 445, 22, 3389).
✔ If stuck, re-enumerate (missed ports = missed shells).
✔ Use -Pn if host seems dead (firewalls block ICMP).

🚀 Final Checklist Before Exploitation

✅ All TCP/UDP ports scanned?
✅ Web directories brute-forced?
✅ SMB/NFS checked for anonymous access?
✅ SNMP/SMTP queried for info leaks?
✅ SSH/RDP tested for weak creds?

💡 Key Takeaway

Enumeration is 80% of hacking. The more you dig, the more you find.

🔥 Now go own those boxes 🔥

Leave a Comment