Scanning, Enumeration, and Exploitation Fundamentals

Week 3 · Week 3: Scanning, Enumeration, and Exploitation Fundamentals · Download .docx

Objectives

Distinguish network scanning from enumeration and explain what each extracts from the target
Explain how OS fingerprinting identifies the target OS without authentication
Describe the role of vulnerability scanners and explain what a false positive means
Explain CVSS scoring and how scores drive remediation prioritization
Define the purpose of Kali Linux and Metasploit in authorized lab testing

Key terms

Network mapping: Building a topology diagram of active hosts, open ports, services, and interconnections from scan results.
Enumeration: Extracting specific data from open services after connection — usernames, share names, group policies, routing tables.
OS fingerprinting: Identifying the target OS by analyzing TCP/IP stack differences: TTL defaults, window sizes, and option ordering.
Vulnerability scanning: Automated comparison of discovered services against a CVE database to identify unpatched weaknesses — identifies, does not confirm exploitability.
CVSS: Common Vulnerability Scoring System — a 0.0–10.0 decimal scale rating vulnerability severity for remediation prioritization.
Kali Linux: Debian-based Linux distribution maintained by Offensive Security, shipping 600+ pre-installed security testing tools for authorized use.
Metasploit Framework: Open-source exploitation platform with a database of exploit modules and payloads for authorized security testing in lab environments.
Payload: The code that executes on the target after an exploit fires — a shell, reverse connection, or command.
False positive: A vulnerability scanner report identifying a weakness that is not actually exploitable in the tested environment.
SMB: Server Message Block — Windows file and printer sharing protocol on port 445; a high-priority enumeration target.

The concept

Scanning and enumeration are two distinct phases in the ethical hacking methodology, and the distinction matters both technically and legally. Scanning is discovery: it identifies which hosts are alive, which ports are open, and which services are listening. Enumeration is extraction: once a connection to an open service is established, enumeration pulls out specific, valuable information — usernames, shared folder names, group policies, running process lists, and routing table entries.

Network mapping takes scan results and builds a topology diagram — a visual representation of every identified host, service, and interconnection. This map defines the attack surface for the rest of the engagement and becomes a key deliverable in the final penetration test report.

OS fingerprinting identifies the operating system without authentication by analyzing behavioral differences in each OS's TCP/IP stack implementation. Different operating systems use different default TTL values (Linux: 64, Windows: 128, Cisco IOS: 255), different TCP window sizes, and different option ordering in TCP headers. A tool like Nmap's OS detection module synthesizes these signals to produce a confidence-ranked OS guess.

Vulnerability scanners such as Nessus and OpenVAS enumerate services on discovered ports, extract version information, and compare those versions against known CVE (Common Vulnerabilities and Exposures) databases. A scanner that reports a vulnerability is stating that the software version matches a known CVE — it does not confirm that the specific vulnerability is exploitable in this environment given the surrounding controls. A finding where the scanner reports a vulnerability that is actually blocked by a firewall rule or other control is a false positive.

The CVSS (Common Vulnerability Scoring System) provides a standardized severity scale from 0.0 to 10.0. Scores drive remediation prioritization: Critical (9.0–10.0) and High (7.0–8.9) findings go to the top of the remediation queue. The scoring accounts for exploitability, impact to confidentiality/integrity/availability, and environmental factors.

Kali Linux ships over 600 pre-configured security testing tools — scanners, password crackers, wireless assessment tools, and exploitation frameworks. It is open-source and maintained by Offensive Security for professional use. Metasploit Framework is the dominant exploitation platform in authorized labs: it provides a database of exploit code and payloads, allowing testers to demonstrate real exploitability against in-scope targets with a structured, reproducible workflow.

Standards: Maryland Blueprint Pillar 3 · EC-Council CEH v12 Domain 4 (Enumeration) + Domain 5 (Vulnerability Analysis) · PGCC INT-2681 Outcomes 3, 4.

Worked examples

Example 1: [object Object]

Example 2: [object Object]

Common mistakes

Confusing scanning with enumeration. Scanning discovers open ports; enumeration extracts data from those open services after connection.
Treating a vulnerability scanner report as confirmed exploitability. A scanner comparing versions against CVE databases does not test actual exploitability — firewall rules, compensating controls, and patch levels affect real risk.
Assuming false positive means 'safe to ignore.' False positives must be documented and the determination explained — some apparent false positives are real vulnerabilities blocked by insufficient controls.
Forgetting that Metasploit use requires explicit written authorization for every target in scope. Using Metasploit outside the authorized scope is unauthorized access under the CFAA.

Self-check

Try each one before you look. A miss here costs nothing and tells you exactly what to reread.

1. Enumeration differs from port scanning because enumeration:

2. CVSS base scores rate vulnerability severity on which scale?

3. A vulnerability scanner reports a finding, but a network firewall blocks the attack path to that service. The finding is classified as:

Canvas is the official record. This companion enhances the PGCC curriculum; it does not replace it. Last name and class year only. Students with a 504 plan or IEP: your accommodations apply.

↑ Back to top