Moving to Active Interaction
Once passive recon is exhausted, we move to Active Scanning and Enumeration. This involves direct interaction with the target's network to confirm information and gather deeper technical details.
Scanning
Scanning primarily focuses on determining the state of ports and services on potential targets within the IP range discovered in Phase 1.
- Goal: Which hosts are alive? What ports are open? Are they TCP or UDP?
Enumeration
Enumeration takes the information discovered during scanning and attempts to extract user accounts, shares, service version numbers, and configuration details.
- Goal: Gaining critical details needed for exploitation (e.g., specific software version 'Apache 2.4.7' is vulnerable to X).
Primary Tool for Scanning: Nmap (Network Mapper), which we will deep dive into next.