Cybersecurity Enumeration

A method used for gathering information about a target by interacting with it, i.e. by using active methods.

This is separate from OSINT which is based exclusively on gathering information from open sources, i.e. using passive methods.

Principles

1. There is more than meets the eye. Consider all points of view.
2. Distinguish between what we see and what we do not see.
3. There are always ways to gain more information. Understand the target.

Methodology

To enumerate a target we usually start from the outside, i.e. most exposed information, and as we possibly gain more access move in to deeper layers that are less exposed.

The enumeration methodology follows 6 sequential layers, moving from the most exposed information (outside) to the least exposed (inside). These layers are then grouped into 3 logical levels based on the enumeration perspective.

Infrastructure-based enumeration

Mapping the target’s entire external footprint from an outside perspective.

Layer 1: Internet presence

Identify externally exposed target systems and interfaces.

Information sources:

• Domains
• Subdomains
• VHosts
• ASN
• Netblocks
• IP Addresses
• Cloud Instances
• Security Measures

Layer 2: Gateway

Identify security measures that protect the target’s internal and external infrastructure.

Information sources:

• Firewalls
• DMZ
• IPS/IDS
• EDR
• Proxies
• NAC
• Network Segmentation
• VPN
• Cloudflare

Host-based enumeration

Analysing a single, specific machine or IP address that has been identified.

Layer 3: Accessible services

Identify accessible interfaces and services that are hosted externally or internally.

Information sources:

• Service Type
• Functionality
• Configuration
• Port
• Version
• Interface

OS-based enumeration

Examining the internal workings of the operating system, assuming some level of access has been gained.

Layer 4: Processes

Identify the internal processes, sources, and destinations associated with the services.

Information sources:

• PID
• Processed Data
• Tasks and their source and target

Layer 5: Privileges

Identify the internal permissions and privileges to the accessible services.

Information sources:

• Groups
• Users
• Permissions
• Restrictions
• Environment

Layer 6: OS Setup

Identification of OS configuration and find sensitive internal files.

Information sources:

• OS type
• Patch level
• Network config
• OS environment
• Configuration files
• Sensitive private files

Examples

• Layer 3 - accessible services: scanning ports with Network Mapper (Nmap)
• Layer 1 - internet presence: Web Enumeration