Ethical Hacking
Service Enumeration
Port scanning tells you a door is open. Service enumeration is you walking up to that door, reading the nameplate, checking the lock type, and listening for what's happening on the other side — before you decide whether to knock.
Version numbers are the real target
Here is something that took me a while to fully appreciate: vulnerabilities are not attached to services. They are attached to versions of services. Apache HTTP Server is not vulnerable. Apache HTTP Server 2.2.8 is. That distinction matters enormously because the moment you know the exact version running on a port, you can cross-reference it against the CVE database and know — before attempting a single exploit — whether a public vulnerability exists, how severe it is, and whether a working proof of concept is available.
Service enumeration is the process of extracting those version numbers, configuration details, and software fingerprints from live services. Some of it happens automatically during an Nmap -sV scan. The rest requires targeted interaction with individual services — connecting to them directly and reading what they reveal about themselves.
Banner grabbing — services that introduce themselves
Many services announce themselves the moment you connect. Open a connection to an FTP server and it greets you with a message — the banner — that often includes the software name, version, and sometimes the operating system it is running on. This is called banner grabbing, and it requires nothing more than a basic TCP connection.
Think of it this way: if someone opens your front door and you immediately say "Hi, I'm John, I live here, this is a three-bedroom house built in 1987" — that is a banner. Some services are that forthcoming. Others are not, which is where deeper enumeration techniques come in.
Services that commonly reveal detailed banners
FTP (port 21)
Software name, version, sometimes OS. Connects instantly with netcat.
SSH (port 22)
Protocol version, software and version visible before authentication.
SMTP (port 25)
Mail server software and version. Supports interactive commands.
HTTP (port 80/443)
Server header reveals web server software, version, sometimes OS and modules.
Telnet (port 23)
Login banner often includes hostname, OS, and distribution details.
MySQL (port 3306)
Database version in the initial handshake packet before auth.
Grabbing banners manually with netcat
Netcat is the closest thing to a universal network conversation tool. It opens raw TCP connections to any port and lets you read and write data directly — no protocol overhead, no framing, just raw bytes. Every pen tester has it in their toolkit and uses it almost daily for things as simple as banner grabbing and as complex as setting up reverse shells.
The scenario: Your Nmap scan found FTP on port 21 and SMTP on port 25 on Metasploitable. The version detection gave you approximate information — but you want to see exactly what each service says when you connect directly. You reach for netcat.
# netcat (nc) opens a raw TCP connection to a host and port
# Whatever the service sends back immediately after connection is the banner
# Active recon — packets reach the target — run only within authorised scope
# -v verbose mode — shows connection status messages
# useful for confirming the connection actually succeeded
# -n skip DNS resolution — connect directly by IP, faster and quieter
# -w 3 wait 3 seconds for a response then exit automatically
# without -w the connection stays open indefinitely after the banner
# Grab the FTP banner on port 21
nc -v -n -w 3 192.168.56.101 21
# Grab the SMTP banner on port 25
nc -v -n -w 3 192.168.56.101 25Breaking it down:
220 is the FTP status code for "service ready." Everything after it is the banner text the server chose to send. In this case vsftpd announced itself by name and version without being asked. That 2.3.4 version number confirms the backdoor finding from Lesson 14 — and you got it with a raw netcat connection in under a second.
The SMTP banner handed you three pieces of intelligence simultaneously: the internal hostname (metasploitable.localdomain), the mail software (Postfix), and the underlying OS (Ubuntu). Internal hostnames are valuable — they sometimes follow naming conventions that reveal information about the organisation's broader infrastructure.
HTTP headers — the server's ID badge
Web servers are particularly talkative. Every HTTP response includes a set of headers — metadata that travels alongside the page content — and those headers frequently include the server software, version, and enabled modules. You do not even need to look at the page itself. Just ask for the headers.
In 2012, researchers discovered a vulnerability in Apache 2.2.x that allowed directory traversal under specific module configurations. Companies running the vulnerable version were identifiable in minutes using nothing more than a curl request to read the Server header. The fix was a version update. The companies that got hit were the ones nobody had enumerated their web server version on.
# curl fetches content from a URL
# We only want the response headers — not the actual page HTML
# Active recon — a real HTTP request hits the target web server
# -I sends a HEAD request instead of GET — fetches headers only, no body content
# faster and produces less traffic than downloading the full page
# -s silent mode — hides curl's progress bar so output stays clean
curl -I -s http://192.168.56.101
# Also check port 8180 where Apache Tomcat is running
# Different port, potentially different software and version
curl -I -s http://192.168.56.101:8180Breaking it down:
The Server header confirmed what Nmap told us — Apache 2.2.8 on Ubuntu with WebDAV enabled. WebDAV is a protocol extension that allows files to be written to the web server remotely. If it is misconfigured, it can allow file upload without authentication — a direct path to dropping a web shell.
PHP 5.2.4 was end-of-life in 2011. Finding it running in any modern environment is a significant finding on its own. This version predates critical security fixes that addressed remote code execution vulnerabilities — cross-reference PHP 5.2.4 against the CVE database and you will find multiple critical entries.
Coyote is the HTTP connector component inside Apache Tomcat. This header confirms Tomcat is running here — which means the /manager/html administration panel almost certainly exists and is worth checking for default credentials. One response header, one confirmed attack vector.
Two curl commands. In the first response alone: Apache version, OS, WebDAV status, PHP version. All of it sitting in the headers of a normal HTTP response. The server told you everything without being pushed.
SMTP enumeration — finding valid users through a mail server
Mail servers have an interesting quirk. The SMTP protocol includes commands — VRFY and EXPN — that were designed to let systems verify whether an email address exists before sending to it. The intent was operational efficiency. The reality is that many mail servers respond differently to valid and invalid usernames — which means you can use them to enumerate which accounts exist on the system.
On a real engagement, confirming which usernames exist on a system feeds directly into the password attack phase. Knowing that "admin," "john.harrison," and "sysadmin" are valid accounts before you start brute-forcing dramatically narrows the target list.
# Connect to the SMTP server interactively using netcat
# We type SMTP commands manually to check whether specific users exist
# The server's response code tells us whether each username is valid
# After the connection opens and shows the 220 banner, type these commands:
# VRFY asks the server to verify whether a username exists
# A 250 response means the user exists — 550 means they do not
# Not all servers honour VRFY — some are configured to always return 252
nc -v -n 192.168.56.101 25
# Then once connected, type these commands one at a time:
# VRFY root
# VRFY admin
# VRFY msfadmin
# VRFY nonexistentuserBreaking it down:
252 means "cannot verify but will try to deliver" — which in practice confirms the user exists. 550 means "user unknown" — the account does not exist. This difference in response is what makes user enumeration possible. You now know root, admin, and msfadmin are valid accounts on this system.
These three confirmed usernames — root, admin, msfadmin — become the username list for the password attack phase. Running a brute-force attempt against 1,000 random usernames wastes time and generates noise. Running it against three confirmed accounts is precise and quiet.
SMB enumeration — what Windows shares are advertising
The Server Message Block protocol is the Windows file and printer sharing protocol — and it is one of the most reliably interesting services to enumerate on any network. SMB shares, user lists, domain information, and OS details are all extractable from a live SMB service using standard enumeration tools. On Linux, Samba implements the SMB protocol, which is why you see it on Metasploitable.
enum4linux is the standard tool for SMB enumeration on Linux. It wraps several underlying tools into a single run and pulls everything it can from a target's SMB service — shares, users, groups, password policies, and OS information — without requiring any credentials if the server allows null sessions.
# enum4linux enumerates information from Windows and Samba SMB services
# It attempts null session connections — connecting without credentials
# If the target allows null sessions (common on older systems) it extracts
# shares, usernames, groups, OS details, and password policy information
# -a runs all basic enumeration checks in a single pass
# equivalent to running shares, users, groups, OS info separately
# Replace the IP with your Metasploitable address
enum4linux -a 192.168.56.101Breaking it down:
A network share mapped with write access — without any credentials. On a real system this means anyone on the network can drop files into /tmp via SMB. Depending on what processes read from /tmp and what permissions they run with, this can be a path to code execution. The comment "oh noes!" was put there by the Metasploitable developers as a hint.
msfadmin, postgres, user, service — all extracted via a null session connection. Combined with the SMTP VRFY results and the MySQL empty root password, you now have a comprehensive user list across multiple services. This list feeds directly into the credential attack phase.
Stop and count what three service enumeration commands produced: confirmed software versions, an internal hostname, WebDAV exposure, an end-of-life PHP version, three valid SMTP usernames, a writable network share, and four system user accounts — all without authenticating to anything or exploiting a single vulnerability. Service enumeration is methodical, unglamorous, and absolutely essential. The teams that skip it are the ones whose reports miss half the attack surface.
Teacher's Note: Suppress the Server header on production web servers. It is one configuration change that removes a significant amount of free intelligence from any attacker running curl against your infrastructure. Hardened systems return "Server: Apache" or nothing at all — not the full version string with modules listed.
Practice questions
Scenario:
Scenario:
Scenario:
Quiz
Scenario:
Scenario:
Scenario:
Up Next · Lesson 17
Vulnerability Scanning
You have a complete service inventory. Now the systematic search for exploitable weaknesses begins — automated scanning, manual validation, and understanding why false positives are more dangerous than they look.