Enumeration Methodology
Below are the summarized notes for the Enumeration Methodology:
Enumeration Methodology Overview
Purpose:
Establish a standardized, systematic approach to gathering information during penetration tests.
Ensures that all aspects of a target's infrastructure are considered and that no important component is overlooked.
Nature of Enumeration:
Dynamic process: Continuously adapts as new information is gathered.
Involves both active (e.g., scanning) and passive (e.g., third-party sources) methods.
Distinct from OSINT: OSINT is strictly passive, while enumeration actively interacts with the target.
Goal:
Not to immediately exploit systems but to discover all potential ways (or "gaps") into the target environment.
Similar to a treasure hunter planning an expedition—study the maps, understand the terrain, and select the proper tools.
Three Levels of Enumeration
Infrastructure-based Enumeration:
Focuses on the external elements of a target (domains, IP ranges, cloud instances, etc.).
Host-based Enumeration:
Examines individual hosts to gather details on services, configurations, and operating systems.
OS-based Enumeration:
Drills down into operating system details, patch levels, configurations, and sensitive files.
The Six Layers of Enumeration Methodology
These layers represent boundaries or “walls” that you need to navigate during an enumeration process.
Layer 1: Internet Presence
Focus: Identify externally accessible infrastructure.
Information Categories:
Domains, Subdomains, vHosts
ASN, Netblocks, IP Addresses
Cloud Instances, Security Measures
Note: The human/OSINT component is excluded here for simplicity.
Layer 2: Gateway
Focus: Understand how the target’s infrastructure is protected and located within the network.
Information Categories:
Firewalls, DMZ, IPS/IDS
EDR, Proxies, NAC
Network Segmentation, VPN, Cloudflare
Goal: Identify security measures and the interface of the reachable target.
Layer 3: Accessible Services
Focus: Examine all services and interfaces (externally or internally hosted) on the target.
Information Categories:
Service Type, Functionality, Configuration
Port, Version, Interface
Goal: Understand the purpose and functionality of each service to determine potential exploitation paths.
Layer 4: Processes
Focus: Identify how data is processed within the system.
Information Categories:
Process IDs (PID), Processed Data, Tasks
Source and Destination of data flows
Goal: Understand the dependencies and relationships between various processes.
Layer 5: Privileges
Focus: Determine the internal permissions and privileges of users and services.
Information Categories:
Groups, Users, Permissions
Restrictions, Environment specifics
Goal: Identify misconfigurations or overlooked privileges that could be exploited.
Layer 6: OS Setup
Focus: Gather detailed information about the operating system and its configuration.
Information Categories:
OS Type, Patch Level
Network configuration, OS Environment
Configuration files, sensitive private files
Goal: Evaluate the internal security posture and administrative capabilities.
Methodology in Practice
Approach:
Not a strict step-by-step guide but a framework summarizing systematic procedures for obtaining knowledge about the target.
The methodology is flexible and can be adapted based on the specific target environment.
Dynamic vs. Static Elements:
Static: The six-layer framework provides consistent boundaries and categories to investigate.
Dynamic: The tools, techniques, and commands used to gather information can vary widely and evolve over time.
Mindset:
Treat the penetration test as navigating a labyrinth where each layer represents a wall or barrier.
Not every vulnerability (“gap”) leads directly inside, but every discovery adds to your overall understanding of the target.
Recognize that even after extended testing, new vulnerabilities may still be discovered—completeness is challenging but understanding is key.
Planning:
Prioritize understanding the target’s architecture and services over immediately jumping into exploitation.
Use the gathered information to map out potential entry points and design a careful, informed plan of attack.
By keeping these principles and layers in mind, you can ensure a comprehensive and systematic enumeration process that maximizes your understanding of the target’s infrastructure before moving into the exploitation phase.
Last updated