Reconnaissance & Enumeration Cheatsheet

Every box on this site starts the same way. Map the attack surface first: a fast full-port sweep, version and default-script scans on what answers, the classic infrastructure ports, then content and vhost discovery on any web server. Nothing here is destructive. It is pure listening.

Port scanning#

A full TCP sweep at a high packet rate, then version and default-script scans on what came back. I run UDP separately because it is slow and I do not want it holding up the TCP results.

bash

# full TCP port sweep, fast, then service/version + default scripts
nmap -sC -sV -p- --min-rate 10000 <IP>

# top UDP ports (IKE, SNMP, TFTP live here)
nmap -sU --top-ports 1000 --min-rate 10000 <IP>

# targeted vuln + safe scripts once you know the ports
nmap -p 445,139 --script "smb-vuln-*" <IP>

# pin the box to a hostname so vhost routing works
echo "<IP> <target>.htb" | sudo tee -a /etc/hosts

Before touching the web app I sweep the classic infrastructure ports. On a domain box these usually hand over the user list, the naming context and the password policy for free, no creds required.

SMB, RPC & shares#

Null sessions are the fastest way in. List shares, enumerate users and read the domain password policy before you have a single credential.

bash

# SMB: null-session share listing + full enum
netexec smb <IP> -u '' -p '' --shares
smbclient -N -L //<IP>/
enum4linux-ng -A <IP>

# RPC null session — users, groups, password policy
rpcclient -U "" -N <IP> -c 'enumdomusers;querydominfo'

LDAP, NFS & SNMP#

The directory itself often answers anonymously, and NFS exports and SNMP community strings leak paths and process detail that shortcut the whole box.

bash

# LDAP: dump the naming context anonymously
ldapsearch -x -H ldap://<IP> -s base namingcontexts
ldapsearch -x -H ldap://<IP> -b "DC=<dom>,DC=htb"

# NFS exports and SNMP community strings
showmount -e <IP>
snmpwalk -v2c -c public <IP>

MQTT (1883)#

An IoT/telemetry broker that frequently allows anonymous subscribe. Dumping every retained topic leaks internal hostnames, health-check URLs and service state for free, and a topic you can also write becomes a poisoning primitive later. mqttui browses the whole tree interactively, and nmap’s mqtt-subscribe grabs the retained payloads in one shot.

bash

# nmap pulls retained topic payloads
nmap -p1883 --script mqtt-subscribe <IP>

# browse every topic anonymously (EdJoPaTo/mqttui)
mqttui -b mqtt://<IP>

# publish a retained value to a writable topic — -r keeps it across reconnects
mqttui -b mqtt://<IP> publish -r "<topic>" '<json-payload>'

Content & virtual-host discovery#

Once a web server answers, I fuzz for content and for virtual hosts. -ac auto-calibrates the filter so I am not drowning in the wildcard response, and -mc all shows every code so I can spot the odd one out.

bash

# directory / file discovery
feroxbuster -u http://<target>.htb -x php,txt,html

# virtual-host fuzzing (spot the subdomain that resolves differently)
ffuf -u http://<target>.htb \
  -H "Host: FUZZ.<target>.htb" \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt \
  -mc all -ac

# parameter fuzzing on a suspect endpoint
ffuf -u "http://<target>.htb/page?FUZZ=1" \
  -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -fs 0