37. Enumeration: NetBIOS, SMB, SNMP, LDAP, SMTP, NFS and DNS
37.8 Putting It Together + Defence Checklist
Raja ani Rani chya fictional Pune shop la ek chota office network aahe: file server (SMB/NFS), printer (SNMP), mail (SMTP), internal DNS, ani nantar AD (Chapter 38). Enumeration attacker la map dete – tumhi defender mhunun aadhi enum kara, mag band kara.
| Protocol | Risk if misconfigured | Defence (short) |
|---|---|---|
| NetBIOS / SMB | Shares, users, null session | No SMBv1, no guest, auth required, firewall, signing |
| SNMP | Device inventory / write community | SNMPv3, ACL, no public/private |
| LDAP | Directory dump via anonymous bind | Disable anon bind, LDAPS, ACL (AD: Ch 38) |
| SMTP | VRFY/EXPN user list | Disable VRFY/EXPN, rate-limit RCPT |
| NFS | Mount sensitive exports | Specific IPs, root_squash, ro, firewall |
| DNS | AXFR full zone leak | Restrict transfer, split DNS, monitor |
Rozcha habit: lab madhe enum try → findings table → fix implement → punha enum (fail zala tar pass). Techi real learning. Aata pudhe jaauya – Active Directory!
Ravindra Bagale's Tip
Memorising a laundry list of tools is of no use. Interviewers ask: "You found an SMB null session – what would you recommend?" State the defence line from the table in your own words. Learn attack and defence together.
Ravindra Bagale's Tip – मराठी
Tools ची laundry list पाठ करणे कामाचे नाही. Interview मध्ये विचारतात: "SMB null session मिळाला – काय recommend करशील?" Table मधली defence line स्वतःच्या शब्दांत बोला. Attack आणि बचाव जोडून शिका.
Ravindra Bagale's Tip – हिंदी
Tools की laundry list रटना किसी काम का नहीं. Interview में पूछते हैं: "SMB null session मिला – क्या recommend करोगे?" Table की defence line अपने शब्दों में बोलो. Attack और बचाव साथ-साथ सीखो.
Practice task
Varcha checklist copy karun expand kara: pratyek row sathi ek concrete command/config (example: showmount -e finding → /etc/exports line; SMTP VRFY → Postfix disable_vrfy_command = yes). Shraddha Bagale la (fictional junior) 6-line paragraph liha: "Why enumeration matters more than a port scan alone."