Service Enumeration: Fingerprinting the Ports

A port scan (nmap) tells you which doors are open. Service enumeration is looking through each door: exact versions, endpoints, shares, and known weaknesses. nmap -sV is the first guess; then you reach for a specialised tool per service. The more detail you gather, the more attack surface you can see.

Rule of thumb: nmap finds the port, a dedicated tool understands the service.

curl , the HTTP swiss-army knife

Why: grab a web server's banner and headers, hit endpoints, follow redirects, test methods, all without a browser.

curl -I http://10.10.10.20         # response headers only (Server, X-Powered-By, cookies)
curl http://10.10.10.20/robots.txt # what the site doesn't want indexed
curl -s -X POST http://target/api  # test other methods

Alternatives: wget, httpie, whatweb (tech fingerprint), your browser's devtools.

nikto , quick web vulnerability scan

Why: a fast first pass over a web server for known-bad files, outdated software, and missing security headers.

nikto -h http://10.10.10.20

It is noisy (easily logged) but great for a quick overview. Alternatives: nuclei, wapiti, OWASP ZAP, Burp Suite's scanner.

nuclei , template-based scanning

Why: run thousands of community YAML templates against a target (or a whole list of hosts) to find CVEs, exposures and misconfigurations, fast and low-noise per check.

nuclei -u http://10.10.10.20
nuclei -l hosts.txt -severity critical,high

Alternatives: nikto (older), jaeles, or writing your own nuclei templates.

enum4linux , SMB/Windows enumeration

Why: on ports 139/445 (SMB), pull users, groups, shares, the password policy, and OS details from Windows or Samba hosts.

enum4linux 10.10.10.20        # or the faster enum4linux-ng

Alternatives: smbmap, rpcclient, netexec (crackmapexec), nmap's smb-enum-* scripts.

smbclient , browse the file shares

Why: once you know shares exist, smbclient is an FTP-like client to list and read them, backups and configs are often left world-readable.

smbclient -L //10.10.10.20        # list shares
smbclient //10.10.10.20/backups   # connect to one (then ls, get)

Alternatives: smbmap, mounting with mount -t cifs.

dig , query DNS

Why: DNS itself is a service. Resolve records to map infrastructure, find mail servers, and try zone transfers.

dig 10.10.10.20                    # A record
dig MX example.com                 # mail servers
dig axfr @ns1.example.com example.com   # zone transfer attempt

Alternatives: nslookup, host, dnsx, dnsrecon.

Try it (terminal)

1. nmap web-01 , find the open ports first.
2. curl -I http://10.10.10.20 and nikto -h 10.10.10.20 , fingerprint the web service.
3. nuclei -u http://10.10.10.20 , template scan for known issues.
4. enum4linux 10.10.10.20 then smbclient -L //10.10.10.20 , the SMB service.
5. dig example.com , the DNS service.

Why this matters

An open port is only a lead. The version and configuration you pull from each service tell you which exploits actually apply, that is the difference between a port list and a way in.