Home > Linux

Service Enumeration

Service enumeration is the deepest, most important phase after discovering open ports. Once you know which ports respond, the next step is understanding exactly what services run on them, which versions they use, how they are configured, and whether they expose authentication endpoints, misconfigurations, debug panels, or vulnerabilities. Every real attack chain begins with service enumeration because this is where you uncover weak versions, insecure services, forgotten admin interfaces, exposed databases, default credentials, weak encryption, outdated frameworks, internal-only services, and development leftovers.

This chapter delivers full-length, in-depth, practical, command-heavy enumeration of every major service type. Every technique includes realistic interpretation so you understand what to do with the results.

Local Service Enumeration (When You Have a Shell)

Local enumeration shows everything the attacker cannot see externally.

List all listening ports with owning processes:

ss -tulnp

Example:

tcp   LISTEN   0      128    0.0.0.0:80    users:(("nginx",pid=1142))
tcp   LISTEN   0      128  127.0.0.1:6379   users:(("redis-server",pid=900))
tcp   LISTEN   0      128    0.0.0.0:22    users:(("sshd",pid=727))

Interpretation:

  • nginx → externally reachable HTTP server

  • redis-server on 127.0.0.1 → internal-only, high-value local privilege escalation target

  • sshd listening on all interfaces → remote entry point

Check the path of the service binary:

ls -l /proc/<PID>/exe

Check startup service configuration:

systemctl status <service>

This tells you how it starts, and whether writable configuration files are involved.

Remote Service Enumeration with Nmap (Primary Tool)

Start with accurate service/version detection:

nmap -sV <target>

Deep version detection:

nmap -sV --version-all <target>

Aggressive mode:

nmap -A <target>

Example output:

22/tcp  open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.7
80/tcp  open  http    Apache httpd 2.4.29
3306/tcp open  mysql   MySQL 5.7.33

Each version can be mapped directly to known CVEs.

Run specialized enumeration scripts:

nmap --script=default,vuln,auth -p <port> <target>

Useful script sets:

  • default → basic fingerprinting

  • vuln → known security vulnerabilities

  • auth → authentication bypass tests

  • brute → username/password brute-force

  • discovery → hidden information leaks

Manual Banner Grabbing

Manual interaction often reveals details automated scanners miss.

Using Netcat

nc <target> <port>

Example for SSH:

nc 192.168.1.10 22

Output:

SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.7

Using Telnet

telnet <target> <port>

Using OpenSSL for TLS

openssl s_client -connect <target>:443

Look for:

  • Server version

  • Framework information

  • Internal hostnames

  • Certificate details

  • Weak encryption

HTTP/HTTPS Web Service Enumeration

Web services require the most enumeration because they often include:

  • APIs

  • Admin panels

  • Frameworks

  • Exposed directories

  • File uploads

  • Misconfigurations

Check headers:

curl -I http://<target>

Verbose full request:

curl -v http://<target>

Enumerate directories:

gobuster dir -u http://<target> -w /usr/share/wordlists/dirb/common.txt

Check HTTPS:

curl -vk https://<target>

Look for technologies:

curl -s http://<target> | grep -Ei "wordpress|drupal|laravel|django|php"

Enumerate virtual hosts:

gobuster vhost -u http://<target> -w subdomains.txt

This often reveals hidden admin panels or development environments.

SSH Service Enumeration

Grab banner:

nc <target> 22

Check your own version for compatibility issues:

ssh -V

Enumerate supported algorithms:

nmap --script ssh2-enum-algos -p22 <target>

Try username enumeration:

ssh <username>@<target>

Detect weak or outdated OpenSSH versions → direct privilege escalation or credential attacks.

FTP Service Enumeration

Grab banner:

nc <target> 21

Try anonymous login:

ftp <target>
Name: anonymous
Password: anonymous

Check for write access:

put test.txt

Enumerate with Nmap:

nmap --script=ftp* -p21 <target>

FTP is frequently misconfigured with:

  • Anonymous read access

  • Anonymous write access

  • Directory traversal

  • Cleartext passwords

SMB / NetBIOS Service Enumeration

List shares, users, and permissions:

enum4linux -a <target>

Check shares:

smbclient -L //<target>/ -N

Connect to a share:

smbclient //<target>/<share> -N

Nmap SMB scripts:

nmap --script smb-enum-shares,smb-enum-users -p445 <target>

Look for:

  • SMBv1 (highly vulnerable)

  • Guest access

  • Writable shares

  • User enumeration

Database Service Enumeration

MySQL / MariaDB

Check access:

mysql -h <target> -u root -p
mysql -h <target> -u root

Check version:

mysql -h <target> -e "select version();"

Nmap:

nmap --script mysql* -p3306 <target>

PostgreSQL

psql -h <target> -U postgres

Check authentication method (trust is insecure).

Redis

redis-cli -h <target> INFO

If no password → severe vulnerability (can write SSH keys).

SMTP Service Enumeration

Banner:

nc <target> 25

User enumeration:

VRFY root
VRFY admin

Check for open relay:

telnet <target> 25
mail from: test@test.com
rcpt to: someone@external.com

Open relay → attacker can send mail from the server.

SNMP Enumeration

SNMP leaks complete system information.

If public works:

snmpwalk -v2c -c public <target>

Extract:

  • Users

  • Processes

  • Network configuration

  • Installed software

  • Hardware info

All of this supports privilege escalation.

RDP / VNC Enumeration

RDP:

nmap -p3389 --script rdp-ntlm-info <target>

VNC:

nmap -p5900 --script vnc-info <target>

Check for:

  • No authentication

  • Weak security settings

  • Exposed desktops

Enumerating Custom / Unknown Services

Identify service:

ss -tulpn | grep <port>

Check process:

ps aux | grep <PID>

Check binary path:

ls -l /proc/<PID>/exe

Dump strings:

strings /proc/<PID>/exe | head

Unknown services frequently reveal:

  • Developer APIs

  • Debug listeners

  • Internal admin consoles

  • Backdoors

  • Malware

Enumerating Services Bound to Localhost Only

Local-only services represent high-value escalation targets.

List internal-only:

ss -tulpn | grep 127.0.0.1

Examples:

  • MySQL

  • Redis

  • Admin panels

  • Insecure testing servers

Once you escalate locally, these become exploitation goldmines.

Practical Service Enumeration Workflow

  1. Identify ports:

nmap -sS -p- <target>

  1. Find services:

nmap -sV <target>

  1. Enumerate each service type:

  • HTTP → curl, gobuster

  • SMB → enum4linux

  • FTP → anonymous login

  • DB → client access

  • SSH → version check

  • Redis → unauth access

  1. Compare internal vs external:

ss -tulpn

  1. Map versions to exploits:

searchsploit <service> <version>

  1. Investigate custom/unknown services manually.

Practical Exploitation Scenarios

Scenario 1: Redis Without Authentication

redis-cli -h <target> INFO

Exploit → write your SSH key into /root/.ssh/authorized_keys.

Scenario 2: Apache/NGINX Outdated

curl -I http://<target>

Enumeration reveals version → map to CVEs → try RCE or directory traversal.

Scenario 3: Anonymous FTP Write

put shell.php

Upload web shell → compromise web server.

Scenario 4: SMB Guest Access

smbclient //<target>/public -N

Steal config files → find DB creds → escalate.

Scenario 5: Exposed Internal Admin Panel on Port 8080

gobuster dir -u http://<target>:8080

Log in with default creds.

Scenario 6: Custom Binary Running as Root

strings /proc/<PID>/exe

Binary vulnerable to buffer overflow or misconfig path → root execution.

Intel Dump

  • Service enumeration reveals the true attack surface

  • Use ss -tulpn locally, nmap -sV remotely

  • Manual banner grabbing exposes deep details

  • HTTP/HTTPS enumeration involves headers, dirs, tech fingerprinting

  • FTP, SMB, SSH, SMTP, SNMP all require specific checks

  • Database services often allow unauthenticated access

  • Redis with no password = instant root compromise

  • SMB guest shares leak sensitive files

  • SNMP public community leaks full system data

  • Unknown services often hide admin tools or malware

  • Internal-only services become targets after local privilege escalation

HOME LEARN COMMUNITY DASHBOARD