Scanning and enumeration in Cybersecurity - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the main purpose of scanning in cybersecurity?

Scanning is used to discover live hosts, open ports, and services on a network to identify potential targets for further analysis.

beginner

Define enumeration in the context of cybersecurity.

Enumeration is the process of gathering detailed information about network resources, users, shares, and services after scanning has identified potential targets.

intermediate

How does scanning differ from enumeration?

Scanning identifies live systems and open ports, while enumeration digs deeper to extract detailed information like usernames, network shares, and service versions.

beginner

Name two common tools used for scanning and enumeration.

Nmap is widely used for scanning networks and ports. Tools like NetBIOS enumeration tools or SNMPwalk are used for enumeration to gather detailed network information.

intermediate

Why is scanning and enumeration important in penetration testing?

They help identify vulnerabilities by mapping the network and gathering detailed information, which guides the tester to exploit weaknesses effectively.

What does scanning primarily detect in a network?

A Live hosts and open ports

B User passwords

C Malware infections

D Firewall rules

Scanning is focused on finding live devices and open ports to understand the network layout.

Which process involves gathering usernames and network shares?

A Scanning

B Phishing

C Exploitation

D Enumeration

Enumeration collects detailed information like usernames and shares after scanning identifies targets.

Which tool is commonly used for network scanning?

A Wireshark

B Metasploit

C Nmap

D John the Ripper

Nmap is a popular tool for scanning networks and discovering open ports.

What is the next step after scanning in a penetration test?

A Enumeration

B Reporting

C Exploitation

D Password cracking

After scanning identifies targets, enumeration gathers detailed information about them.

Why should scanning and enumeration be done carefully?

A They delete important files

B They can alert network defenders

C They always cause system crashes

D They are illegal in all cases

Scanning and enumeration can trigger alerts, so they must be done cautiously to avoid detection.

Explain the difference between scanning and enumeration in cybersecurity.

Think about what each step discovers about the network.

Describe why scanning and enumeration are important steps in penetration testing.

Consider how these steps help a tester understand the network.

Practice

1. What is the main purpose of scanning in cybersecurity?

easy

A. To find active devices and open ports on a network

B. To collect detailed user account information

C. To encrypt data during transmission

D. To block unauthorized access automatically

Solution

1. Step 1: Understand scanning basics

   Scanning is used to detect which devices are active and which ports are open on a network.

2. Step 2: Differentiate from enumeration

   Enumeration goes deeper to gather detailed info, but scanning is about discovery.

3. Final Answer:

   To find active devices and open ports on a network -> Option A

4. Quick Check:

   Scanning = Finding devices and ports [OK]

Hint: Scanning finds devices and ports first, enumeration follows [OK]

Common Mistakes:

• Confusing scanning with enumeration
• Thinking scanning encrypts data
• Assuming scanning blocks access

2. Which of the following is the correct syntax to run a basic port scan using the Nmap tool?

easy

A. nmap scan 192.168.1.1 -open

B. nmap -sS 192.168.1.1

C. scan -nmap 192.168.1.1

D. nmap --list-ports 192.168.1.1

Solution

1. Step 1: Identify correct Nmap command format

   The correct Nmap syntax for a TCP SYN scan is nmap -sS [target].

2. Step 2: Check options for errors

   Options like 'scan' or '--list-ports' are incorrect or invalid in this context.

3. Final Answer:

   nmap -sS 192.168.1.1 -> Option B

4. Quick Check:

   Nmap SYN scan = nmap -sS [IP] [OK]

Hint: Nmap SYN scan uses -sS flag before target IP [OK]

Common Mistakes:

• Using invalid flags like --list-ports
• Placing options after IP incorrectly
• Confusing scan command syntax

3. Consider this Nmap output snippet:

PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
443/tcp  closed https

What does this output tell you about port 443?

medium

A. Port 443 is closed and not accepting connections

B. Port 443 is filtered by a firewall

C. Port 443 is open and accepting connections

D. Port 443 is in an unknown state

Solution

1. Step 1: Read port state from output

   The output shows port 443/tcp as 'closed', meaning it is not open for connections.

2. Step 2: Understand port states

   'Closed' means the port is reachable but no service is listening; 'filtered' would mean blocked by firewall.

3. Final Answer:

   Port 443 is closed and not accepting connections -> Option A

4. Quick Check:

   Port 443 state = closed means no connection [OK]

Hint: Closed port means reachable but no service listening [OK]

Common Mistakes:

• Confusing closed with filtered
• Assuming closed means open
• Ignoring port state labels

4. You run an enumeration command but get no detailed user info. Which of these is the most likely cause?

medium

A. The target device is offline

B. The network cable is unplugged

C. You used scanning instead of enumeration

D. The enumeration tool lacks proper permissions

Solution

1. Step 1: Analyze why enumeration fails

   Enumeration requires permissions to access detailed info; without them, it returns nothing.

2. Step 2: Eliminate other options

   If the device was offline or cable unplugged, scanning would fail too; scanning vs enumeration is about info depth, not success.

3. Final Answer:

   The enumeration tool lacks proper permissions -> Option D

4. Quick Check:

   Permissions needed for enumeration details [OK]

Hint: No info? Check permissions for enumeration tool [OK]

Common Mistakes:

• Confusing scanning failure with enumeration failure
• Ignoring permission requirements
• Assuming device offline without checking

5. You want to create a report listing all active devices and their open ports on a network, then gather usernames from those devices. Which sequence of actions is best?

hard

A. Run enumeration first, then scanning

B. Only run enumeration since it finds devices and usernames

C. Run scanning to find devices and ports, then enumeration for usernames

D. Only run scanning since it finds all info needed

Solution

1. Step 1: Understand scanning and enumeration roles

   Scanning finds active devices and open ports; enumeration collects detailed info like usernames.

2. Step 2: Determine correct order

   You must scan first to identify targets, then enumerate those targets for detailed info.

3. Final Answer:

   Run scanning to find devices and ports, then enumeration for usernames -> Option C

4. Quick Check:

   Scan first, then enumerate details [OK]

Hint: Scan to find devices, enumerate for details next [OK]

Common Mistakes:

• Reversing scanning and enumeration order
• Assuming scanning finds usernames
• Skipping scanning step