Service Enumeration Tools

Comprehensive collection of service enumeration tools and techniques for network reconnaissance and penetration testing.

# Telnet banner grab
telnet TARGET_IP 80
telnet TARGET_IP 443
telnet TARGET_IP 21
telnet TARGET_IP 25
telnet TARGET_IP 22

# Netcat banner grab
nc TARGET_IP 80
nc TARGET_IP 443
nc TARGET_IP 21
nc TARGET_IP 25
nc TARGET_IP 22

# Nmap banner grab
nmap -sV --script banner TARGET_IP

# Curl banner grab
curl -I http://TARGET_IP
curl -I https://TARGET_IP

# Wget banner grab
wget --spider -S http://TARGET_IP
wget --spider -S https://TARGET_IP

# OpenSSL banner grab
openssl s_client -connect TARGET_IP:443
openssl s_client -connect TARGET_IP:993
openssl s_client -connect TARGET_IP:995

# SMTP banner grab
nc TARGET_IP 25
nc TARGET_IP 587
nc TARGET_IP 465

# FTP banner grab
nc TARGET_IP 21
nc TARGET_IP 990

# SSH banner grab
nc TARGET_IP 22

# HTTP banner grab with headers
curl -I -H "User-Agent: Mozilla/5.0" http://TARGET_IP

# HTTPS banner grab with headers
curl -I -H "User-Agent: Mozilla/5.0" https://TARGET_IP

# HTTP banner grab with custom headers
curl -I -H "User-Agent: CustomAgent" -H "Accept: */*" http://TARGET_IP

# HTTPS banner grab with custom headers
curl -I -H "User-Agent: CustomAgent" -H "Accept: */*" https://TARGET_IP

# HTTP banner grab with proxy
curl -I --proxy http://proxy:8080 http://TARGET_IP

# HTTPS banner grab with proxy
curl -I --proxy http://proxy:8080 https://TARGET_IP

# HTTP banner grab with timeout
curl -I --connect-timeout 10 http://TARGET_IP

# HTTPS banner grab with timeout
curl -I --connect-timeout 10 https://TARGET_IP

# HTTP banner grab with verbose
curl -I -v http://TARGET_IP

# HTTPS banner grab with verbose
curl -I -v https://TARGET_IP

Version Detection

Nmap Version Detection

# Basic version detection
nmap -sV TARGET_IP

# Version detection with specific ports
nmap -sV -p 80,443,8080,8443 TARGET_IP

# Version detection with all ports
nmap -sV -p- TARGET_IP

# Version detection with intensity
nmap -sV --version-intensity 9 TARGET_IP

# Version detection with light intensity
nmap -sV --version-intensity 1 TARGET_IP

# Version detection with all probes
nmap -sV --version-all TARGET_IP

# Version detection with trace
nmap -sV --version-trace TARGET_IP

# Version detection with debug
nmap -sV --version-debug TARGET_IP

# Version detection with verbose
nmap -sV -v TARGET_IP

Advanced Version Detection

# Version detection with OS detection
nmap -sV -O TARGET_IP

# Version detection with script scanning
nmap -sV -sC TARGET_IP

# Version detection with custom scripts
nmap -sV --script vuln TARGET_IP

# Version detection with output file
nmap -sV -oN results.txt TARGET_IP

# Version detection with XML output
nmap -sV -oX results.xml TARGET_IP

# Version detection with JSON output
nmap -sV -oJ results.json TARGET_IP

# Version detection with grep output
nmap -sV -oG results.grep TARGET_IP

# Version detection with all formats
nmap -sV -oA results TARGET_IP

Service-Specific Enumeration

HTTP Service Enumeration

# HTTP enumeration
nmap --script http-enum TARGET_IP
nmap --script http-headers TARGET_IP
nmap --script http-methods TARGET_IP
nmap --script http-robots.txt TARGET_IP
nmap --script http-sitemap-generator TARGET_IP
nmap --script http-title TARGET_IP
nmap --script http-vhosts TARGET_IP

# HTTP authentication
nmap --script http-auth TARGET_IP
nmap --script http-auth-finder TARGET_IP
nmap --script http-brute TARGET_IP
nmap --script http-form-brute TARGET_IP
nmap --script http-form-fuzzer TARGET_IP

# HTTP vulnerabilities
nmap --script http-vuln-cve2010-0738 TARGET_IP
nmap --script http-vuln-cve2010-2861 TARGET_IP
nmap --script http-vuln-cve2011-3192 TARGET_IP
nmap --script http-vuln-cve2011-3368 TARGET_IP
nmap --script http-vuln-cve2012-1823 TARGET_IP
nmap --script http-vuln-cve2013-0156 TARGET_IP
nmap --script http-vuln-cve2013-6786 TARGET_IP
nmap --script http-vuln-cve2014-2126 TARGET_IP
nmap --script http-vuln-cve2014-2127 TARGET_IP
nmap --script http-vuln-cve2014-2128 TARGET_IP
nmap --script http-vuln-cve2014-2129 TARGET_IP
nmap --script http-vuln-cve2014-2130 TARGET_IP
nmap --script http-vuln-cve2014-2131 TARGET_IP
nmap --script http-vuln-cve2014-2132 TARGET_IP
nmap --script http-vuln-cve2014-2133 TARGET_IP
nmap --script http-vuln-cve2014-2134 TARGET_IP
nmap --script http-vuln-cve2014-2135 TARGET_IP
nmap --script http-vuln-cve2014-2136 TARGET_IP
nmap --script http-vuln-cve2014-2137 TARGET_IP
nmap --script http-vuln-cve2014-2138 TARGET_IP
nmap --script http-vuln-cve2014-2139 TARGET_IP
nmap --script http-vuln-cve2014-2140 TARGET_IP

SMB Service Enumeration

# SMB enumeration
nmap --script smb-enum-shares TARGET_IP
nmap --script smb-enum-users TARGET_IP
nmap --script smb-enum-groups TARGET_IP
nmap --script smb-enum-domains TARGET_IP
nmap --script smb-os-discovery TARGET_IP
nmap --script smb-protocols TARGET_IP
nmap --script smb-security-mode TARGET_IP
nmap --script smb-system-info TARGET_IP

# SMB authentication
nmap --script smb-brute TARGET_IP
nmap --script smb-enum-sessions TARGET_IP
nmap --script smb-enum-sessions TARGET_IP
nmap --script smb-enum-sessions TARGET_IP

# SMB vulnerabilities
nmap --script smb-vuln-cve2009-3103 TARGET_IP
nmap --script smb-vuln-cve2010-0476 TARGET_IP
nmap --script smb-vuln-cve2010-0476 TARGET_IP
nmap --script smb-vuln-cve2010-0476 TARGET_IP
nmap --script smb-vuln-cve2010-0476 TARGET_IP
nmap --script smb-vuln-cve2010-0476 TARGET_IP
nmap --script smb-vuln-cve2010-0476 TARGET_IP
nmap --script smb-vuln-cve2010-0476 TARGET_IP
nmap --script smb-vuln-cve2010-0476 TARGET_IP
nmap --script smb-vuln-cve2010-0476 TARGET_IP
nmap --script smb-vuln-cve2010-0476 TARGET_IP
nmap --script smb-vuln-cve2010-0476 TARGET_IP
nmap --script smb-vuln-cve2010-0476 TARGET_IP
nmap --script smb-vuln-cve2010-0476 TARGET_IP
nmap --script smb-vuln-cve2010-0476 TARGET_IP
nmap --script smb-vuln-cve2010-0476 TARGET_IP
nmap --script smb-vuln-cve2010-0476 TARGET_IP
nmap --script smb-vuln-cve2010-0476 TARGET_IP
nmap --script smb-vuln-cve2010-0476 TARGET_IP
nmap --script smb-vuln-cve2010-0476 TARGET_IP
nmap --script smb-vuln-cve2010-0476 TARGET_IP

SNMP Service Enumeration

# SNMP enumeration
nmap --script snmp-info TARGET_IP
nmap --script snmp-brute TARGET_IP
nmap --script snmp-communities TARGET_IP
nmap --script snmp-hh3c-logins TARGET_IP
nmap --script snmp-interfaces TARGET_IP
nmap --script snmp-ios-config TARGET_IP
nmap --script snmp-netstat TARGET_IP
nmap --script snmp-processes TARGET_IP
nmap --script snmp-public TARGET_IP
nmap --script snmp-sysdescr TARGET_IP
nmap --script snmp-win32-services TARGET_IP
nmap --script snmp-win32-shares TARGET_IP
nmap --script snmp-win32-software TARGET_IP
nmap --script snmp-win32-users TARGET_IP

# SNMP authentication
nmap --script snmp-brute TARGET_IP
nmap --script snmp-communities TARGET_IP
nmap --script snmp-hh3c-logins TARGET_IP

# SNMP vulnerabilities
nmap --script snmp-vuln-cve2010-0476 TARGET_IP
nmap --script snmp-vuln-cve2010-0476 TARGET_IP
nmap --script snmp-vuln-cve2010-0476 TARGET_IP
nmap --script snmp-vuln-cve2010-0476 TARGET_IP
nmap --script snmp-vuln-cve2010-0476 TARGET_IP
nmap --script snmp-vuln-cve2010-0476 TARGET_IP
nmap --script snmp-vuln-cve2010-0476 TARGET_IP
nmap --script snmp-vuln-cve2010-0476 TARGET_IP
nmap --script snmp-vuln-cve2010-0476 TARGET_IP
nmap --script snmp-vuln-cve2010-0476 TARGET_IP
nmap --script snmp-vuln-cve2010-0476 TARGET_IP
nmap --script snmp-vuln-cve2010-0476 TARGET_IP
nmap --script snmp-vuln-cve2010-0476 TARGET_IP
nmap --script snmp-vuln-cve2010-0476 TARGET_IP
nmap --script snmp-vuln-cve2010-0476 TARGET_IP
nmap --script snmp-vuln-cve2010-0476 TARGET_IP
nmap --script snmp-vuln-cve2010-0476 TARGET_IP
nmap --script snmp-vuln-cve2010-0476 TARGET_IP
nmap --script snmp-vuln-cve2010-0476 TARGET_IP
nmap --script snmp-vuln-cve2010-0476 TARGET_IP
nmap --script snmp-vuln-cve2010-0476 TARGET_IP

FTP Service Enumeration

# FTP enumeration
nmap --script ftp-anon TARGET_IP
nmap --script ftp-bounce TARGET_IP
nmap --script ftp-brute TARGET_IP
nmap --script ftp-libopie TARGET_IP
nmap --script ftp-proftpd-backdoor TARGET_IP
nmap --script ftp-syst TARGET_IP
nmap --script ftp-vsftpd-backdoor TARGET_IP
nmap --script ftp-vuln-cve2010-4221 TARGET_IP

# FTP authentication
nmap --script ftp-brute TARGET_IP
nmap --script ftp-anon TARGET_IP

# FTP vulnerabilities
nmap --script ftp-vuln-cve2010-4221 TARGET_IP
nmap --script ftp-proftpd-backdoor TARGET_IP
nmap --script ftp-vsftpd-backdoor TARGET_IP

SSH Service Enumeration

# SSH enumeration
nmap --script ssh-hostkey TARGET_IP
nmap --script ssh-brute TARGET_IP
nmap --script ssh-publickey-acceptance TARGET_IP
nmap --script ssh-run TARGET_IP
nmap --script ssh2-enum-algos TARGET_IP
nmap --script sshv1 TARGET_IP

# SSH authentication
nmap --script ssh-brute TARGET_IP
nmap --script ssh-publickey-acceptance TARGET_IP

# SSH vulnerabilities
nmap --script sshv1 TARGET_IP
nmap --script ssh-hostkey TARGET_IP

SMTP Service Enumeration

# SMTP enumeration
nmap --script smtp-commands TARGET_IP
nmap --script smtp-enum-users TARGET_IP
nmap --script smtp-ntlm-info TARGET_IP
nmap --script smtp-open-relay TARGET_IP
nmap --script smtp-strangeport TARGET_IP
nmap --script smtp-vuln-cve2010-4344 TARGET_IP
nmap --script smtp-vuln-cve2011-1720 TARGET_IP
nmap --script smtp-vuln-cve2011-1764 TARGET_IP

# SMTP authentication
nmap --script smtp-enum-users TARGET_IP
nmap --script smtp-brute TARGET_IP

# SMTP vulnerabilities
nmap --script smtp-vuln-cve2010-4344 TARGET_IP
nmap --script smtp-vuln-cve2011-1720 TARGET_IP
nmap --script smtp-vuln-cve2011-1764 TARGET_IP

Custom Service Enumeration

Python Service Enumeration

import socket
import threading
import queue
import time
import requests

def service_enumeration(target, ports, threads=10, delay=0):
    def worker():
        while True:
            try:
                port = ports.get()
                if port is None:
                    break
                
                # Check if port is open
                sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
                sock.settimeout(1)
                result = sock.connect_ex((target, port))
                
                if result == 0:
                    # Try to grab banner
                    try:
                        if port == 80:
                            response = requests.get(f'http://{target}', timeout=5)
                            print(f"[HTTP] {target}:{port} - {response.headers.get('Server', 'Unknown')}")
                        elif port == 443:
                            response = requests.get(f'https://{target}', timeout=5, verify=False)
                            print(f"[HTTPS] {target}:{port} - {response.headers.get('Server', 'Unknown')}")
                        elif port == 21:
                            sock.send(b'USER anonymous\r\n')
                            banner = sock.recv(1024).decode('utf-8', errors='ignore')
                            print(f"[FTP] {target}:{port} - {banner.strip()}")
                        elif port == 22:
                            banner = sock.recv(1024).decode('utf-8', errors='ignore')
                            print(f"[SSH] {target}:{port} - {banner.strip()}")
                        elif port == 25:
                            banner = sock.recv(1024).decode('utf-8', errors='ignore')
                            print(f"[SMTP] {target}:{port} - {banner.strip()}")
                        else:
                            print(f"[OPEN] {target}:{port}")
                    except:
                        print(f"[OPEN] {target}:{port}")
                
                sock.close()
                time.sleep(delay)
                
            except Exception as e:
                pass
            finally:
                ports.task_done()
    
    # Start threads
    for i in range(threads):
        t = threading.Thread(target=worker)
        t.daemon = True
        t.start()
    
    # Add ports to queue
    for port in range(1, 65536):
        ports.put(port)
    
    # Wait for completion
    ports.join()

# Usage
target = "TARGET_IP"
ports = queue.Queue()
service_enumeration(target, ports, threads=100, delay=0.01)

Bash Service Enumeration

#!/bin/bash

TARGET_IP="TARGET_IP"
THREADS=10

# Function to check service
check_service() {
    local port=$1
    local target=$2
    
    if timeout 1 bash -c "echo >/dev/tcp/$target/$port" 2>/dev/null; then
        # Try to grab banner
        case $port in
            80)
                banner=$(curl -s -I "http://$target" | grep -i "server:" | cut -d' ' -f2-)
                echo "[HTTP] $target:$port - $banner"
                ;;
            443)
                banner=$(curl -s -I "https://$target" | grep -i "server:" | cut -d' ' -f2-)
                echo "[HTTPS] $target:$port - $banner"
                ;;
            21)
                banner=$(echo "QUIT" | nc "$target" "$port" 2>/dev/null | head -1)
                echo "[FTP] $target:$port - $banner"
                ;;
            22)
                banner=$(nc "$target" "$port" 2>/dev/null | head -1)
                echo "[SSH] $target:$port - $banner"
                ;;
            25)
                banner=$(nc "$target" "$port" 2>/dev/null | head -1)
                echo "[SMTP] $target:$port - $banner"
                ;;
            *)
                echo "[OPEN] $target:$port"
                ;;
        esac
    fi
}

# Export function for parallel
export -f check_service
export TARGET_IP

# Run parallel service check
seq 1 65535 | parallel -j "$THREADS" check_service {} "$TARGET_IP"

Best Practices

Rate Limiting

# Add delay between requests
nmap -T2 TARGET_IP

# Use fewer threads
nmap -T1 TARGET_IP

# Use proxy rotation
nmap -sS --proxies http://proxy1:8080,http://proxy2:8080 TARGET_IP

Stealth Mode

# Use random timing
nmap -T3 --randomize-hosts TARGET_IP

# Use fragment packets
nmap -sS -f TARGET_IP

# Use decoy scans
nmap -sS -D decoy1,decoy2,decoy3 TARGET_IP

# Use source port spoofing
nmap -sS --source-port 53 TARGET_IP

Output Analysis

# Save results to file
nmap -sV -oN results.txt TARGET_IP

# Filter by service
grep "http" results.txt
grep "ssh" results.txt
grep "ftp" results.txt
grep "smb" results.txt
grep "snmp" results.txt

# Filter by version
grep "Apache" results.txt
grep "nginx" results.txt
grep "IIS" results.txt
grep "OpenSSH" results.txt
grep "vsftpd" results.txt

Troubleshooting

Common Issues

# Connection timeout
nmap -T1 TARGET_IP

# Too many requests
nmap -T0 TARGET_IP

# Invalid target
nmap -sn TARGET_NETWORK

# Permission denied
sudo nmap -sS TARGET_IP

Performance Optimization

# Use appropriate timing
nmap -T4 TARGET_IP

# Use smaller port ranges
nmap -p 1-1000 TARGET_IP

# Use specific scripts
nmap --script vuln TARGET_IP

Legal and Ethical Considerations

Always obtain proper authorization before testing
Respect rate limits and server resources
Use appropriate tools for the target
Document findings properly
Follow responsible disclosure practices

🔧 Security Tools

Connection Settings

Service Enumeration Tools

Service Enumeration Tools

Banner Grabbing

Basic Banner Grabbing

Advanced Banner Grabbing

Version Detection

Nmap Version Detection

Advanced Version Detection

Service-Specific Enumeration

HTTP Service Enumeration

SMB Service Enumeration

SNMP Service Enumeration

FTP Service Enumeration

SSH Service Enumeration

SMTP Service Enumeration

Custom Service Enumeration

Python Service Enumeration

Bash Service Enumeration

Best Practices

Rate Limiting

Stealth Mode

Output Analysis

Troubleshooting

Common Issues

Performance Optimization

Legal and Ethical Considerations