Initial Enumeration of the Domain

Context/Setting: In the following context, we are on a local network (172.0.0.1)

• Key Data Points
  • AD Users ---> Enumerate valid user account we can target for password spaying
  • Ad Joined Computer ---> Key computers include domain controllers, file servers, web servers, exchange mail servers, database servers, ...
  • Key Services ---> Kerberos, NetBIOS, LDAP, DNS
  • Vulnerable Host and Services ---> Anything that can be a quick win (Easy host to exploit and gain a foothold)

Fping (Replace Nmap to simply verify what IP are active)

fping -asgq LOCAL-IP/23

• -a ---> Show all of the hosts that are responding
• -q ---> Suppress the display of the individual ping results for each host.
• /23 ---> A subnet mask of /23 (e.g. 192.168.0.1/23) specifies that the network includes all IP addresses from 192.168.0.1 to 192.168.1.254. (Specific to this example)

Nmap Scan

nmap -iL /path/to/file.txt -p-                          ---> Can add --min-rate=9856
nmap -sC -sV -iL /path/to/file.txt -p PORTS-FOUND       ---> Can add --min-rate=9856