All right.
I guess a better title would have been some other enumeration techniques, as you know, when we discuss
things like this.
I'm not trying to be comprehensive.
I am going to go through enumerations that we definitely need to be aware of.
The Lightweight Directory Access Protocol or El LDAP is a wonderful technology that is often used for
the storage of user accounts groups, that type of information.
It stores this in a standards based database format.
There's schemas.
There's all this standardization that companies love to take advantage of.
But of course, this can be enumerated with tools like software as LDAP administrator, something that
would be very useful in the hands of an actual admin, but very, very dangerous in the hands of a computer
criminal, of course.
So we need to be diligent about securing ELD app whenever possible.
Of course, because we want to harden these systems so that this information cannot be reconnaissance
and enumerated.
Now, something that grew out of lightweight directory access protocol is Microsoft's Active Directory.
So it is l dap compliant.
It follows the standards of LDAP, but there is a ton of additional security mechanisms and additional
proprietary Microsoft technologies bolted on to this LDAP shell, if you will.
We know there's the concept of a domain controller that maintains this.
Microsoft Active Directory and Kerberos is the security technology that is used to keep everything secure.
Kerberos, I believe.
Isn't that the three headed dog that guards Hades in mythology?
Yeah.
So the Kerberos security protocol is a big deal, keeping the security IDs or SSIDs safe and all that
stuff that's going to be in the domain controller.
Now, to really modernize this discussion, I don't see a lot of conversation yet about this in ethical
hacking books, in courses.
I want you to have the latest information.
Understand that Microsoft's Active Directory, when we say NSA, we are talking about the classic tried
and true domain controller based Active Directory for user accounts and groups and computer accounts
and burner accounts and all that great stuff.
We are not talking about Arms A D, which is Microsoft Azure Active Directory.
One of the biggest misconceptions is that Azure Active Directory is Microsoft Active Directory.
It is not.
In fact, Azure Active Directory is not even ELD compliant.
So it is very different technology.
They named it Active Directory because it's doing what classic Active Directory does, but it's a complete
cloud based implementation.
Now if you have an Azure Active Directory and you want to suck in your normal Microsoft Active Directory
accounts and users and all that, they have a Kinect tool that allows that to easily be accomplished.
Suffice it to say that today you have a lot of options when it comes to your Microsoft Active Directory.
You could go build a traditional one in the cloud, or you could say tech with that, and you could
start with Azure Active Directory.
Network time protocol is one of those protocols that it gets picked on here in the cybersecurity landscape.
We love network time protocol because it's going to synchronize in an automated fashion the time on
all of our network nodes, hopefully all of our network nodes and everyone will agree on the same accurate
time.
In fact, network time protocol can be fed from a atomic clock, a very accurate time source.
So wait a minute here.
Are attackers going to be enumerating us for the correct time?
Well, they're not wearing a watch.
No, that's not what they're going to do.
You see, they leverage the network time protocol to enumerate host information.
IP address information, system names, even operating systems.
And this really points us to a powerful and disturbing trend in hacking, both ethical and unethical.
And that is the fact that many times we can leverage a protocol like network time protocol to enumerate
something that we wouldn't even think about.
Right.
Like, you know, you think about it and you're like, oh, it's just distributing time.
I'm not going to worry about enumeration.
Wait a minute.
It can help enumerate all these items that you see on screen.
We might not have thought of that.
And we know the designers of A.P. certainly didn't think of the protocol being attacked in this way.
Now in the Linux environment, there's no update, no trace, and TCP DC and DPD queue that's configuring
or querying the network time protocol.
Damon So these are all utilities that are sometimes built in to Linux distros or can easily be added
to Linux distros for working with troubleshooting and twrp.
Of course, the only problem is when they fall into the wrong hands, they become powerful enumeration
tools.
Oh, my goodness.
You talk about enumerating like a treasure trove of information, like the ultimate enumeration location.
Boy, it would be DNS, wouldn't it?
DNS is going to have all of these great system names.
Two IP address mappings.
Yikes.
This would be, again, a treasure trove of information for someone attempting to enumerate your network
and think about zone transfers.
Not transfers.
Zone transfers.
Once again, my optical character recognition software is struggling on TS and FS.
Yeah, zone transfers are when we are having one DNS server update another with all of the DNS records
or a partial list of them.
We can do full or partial zone transfers.
Well, imagine the DNS system transferring all the records to the attacker.
This could be done if we didn't secure things and they knew how to use Digg or not.
Look up common tools.
Many times embedded into operating systems.
For instance, Windows has NSA look up for sure.
It may even have Digg.
So we know Unix boxes will as well.
DNS recon is another tool not built in, but it can be very valuable for the enumeration of zone transfer
information.
But that's not it.
When it comes to DNS, it's such a powerful enumerator that you could have cache, snooping, taking
place.
So this is when they're not trying to get the whole zone, but they are trying to resolve names to IP
addresses and they're looking in servers that are caching this DNS information.
This attack can be done recursively or non recursively.
What does that mean?
Well, recursive means that we all go and ask the cache server for a name two IP address mapping and
if it doesn't know it, it will go take action trying to fetch it.
Or a non recursive where if it doesn't know it, it'll stop right there.
Cache snooping can be carried out both recursively and non recursively by the attackers.
Their style would depend on the DNS architecture.
Really?
Now, what about mitigating these frightening types of DNS enumerations?
Well, yeah, we are going to harden DNS servers big time, and they're only going to trust other authorized
DNS infrastructure components.
So we're going to be using access control lists.
We're going to be using firewalls, intrusion prevention systems here big time.
Also, by the way, on the subject of zone transfers.
There's technology now like DNS transaction signatures that are going to make this highly, highly secure.
So sure enough, we need to stay on top of new technological advancements with DNS, and they almost
always tend to be in the area of security.
Hey, how about IP seq enumeration?
Well, we'd probably be going after UDP port 500.
And we might be using a tool like IHC scan in order to get the internet key exchange data as much information
as we can about how the company is using IP SEQ to build VPNs.
Voice over IP could be enumerated.
There's the session initialization protocol or SIP that runs over TCP and UDP ports.
2012 one 5050 and 5061.
Well, how about a weird range of port numbers to memorize there, but these are the ports that would
be enumerated when we're going after voice over IP traffic.
How about Linux and Unix users?
We talked about Active Directory or Azure Active Directory in Microsoft environments.
Well, in Linux in Unix environments, there's our users finger and Yahoo!
Utilities that again are very valuable in the hands of the bona fide administrator but are very dangerous
in the hands of the computer criminal.
So yeah, that's just a smattering of other powerful enumeration techniques that exist.
And it sure makes us feel like we've got some job security, doesn't it?
That's always a good thing.