CEH Module 4 Enumeration Mind Map By InfosecTrain

Enumeration is the post-port scanning phase where ethical hackers extract usernames, machine names, and network resources. It’s a critical step in understanding the network’s structure, services, and potential vulnerabilities — laying the groundwork for deeper penetration testing.

🔍 Key Techniques Covered:
NetBIOS Enumeration → Shared resources, domain info, user accounts.
SNMP Enumeration → Device configs, running processes, interfaces.
LDAP Enumeration → Directory details, usernames, org structure.
SMTP Enumeration → User discovery, email addresses.
DNS Enumeration → Records, domains, network mapping.

💡 Why it matters: Enumeration isn’t just about data gathering—it’s about exposing weak configurations, mismanaged services, and hidden entry points that attackers could exploit.

2. CEH MODULE 4
Definition
Purpose
Importance
Techniques
Extracting usernames, machine names,
and network resources, done post-port scanning.
Gather detailed system info; identify
network shares/services.
Supports further exploitation and maps the
network and security posture.
SNMP Enumeration
NetBIOS Enumeration
LDAP Enumeration
NTP Enumeration
SMTP Enumeration
DNS Enumeration
www.infosectrain.com
ENUMERATION OVERVIEW

3. www.infosectrain.com
Purpose
Tools
Info Retrieved
Enabled
Attacks
CEH MODULE 4
NETBIOS ENUMERATION
Collect info about networked computers.
Unauthorized access
Exploitation
nbtstat
NetView
Hyena
Shared resources
Usernames
Group names
Domain info

4. www.infosectrain.com
Purpose
Protocol
Tools
Data Retrieved
Risks
SNMP ENUMERATION
Configurations
Running processes
Network interfaces
snmpwalk
snmpenum
OpUtils
CEH MODULE 4
Data from network devices.
SNMP on UDP ports 161/162.
Default community strings (e.g., public/private)
can expose info.

5. www.infosectrain.com
CEH MODULE 4
LDAP ENUMERATION
Purpose
Protocol
Tools
Data Retrieved
Risks
Usernames
Group names
Org details
Softerra LDAP Administrator
JXplorer
ldapsearch
LDAP on TCP port 389.
Weak configurations = data exposure.
Access directory services
Extract user/group info

6. www.infosectrain.com
CEH MODULE 4
SMTP ENUMERATION
Purpose
Protocol
Tools
Data Retrieved
Risks
Telnet
Nmap NSE scripts
smtp-user-enum
VRFY
EXPN
RCPT TO
SMTP on port 25.
Harvesting, leakage, phishing/spam.
Discover email addresses
Identify users.

7. www.infosectrain.com
CEH MODULE 4
DNS ENUMERATION
Purpose
Record
Types
Techniques
Tools
Risks
nslookup
dig
Fierce
DNSenum
Zone transfer
Brute force
Reverse lookup
A, MX, NS, CNAME, SOA.
Info disclosure, network mapping, attack surface expansion.
Extract DNS records
Domain info.

8. To Get More Insights Through Our FREE
FOUND THIS USEFUL?
Courses | Workshops | eBooks | Checklists | Mock Tests
LIKE FOLLOWSHARE