Network Service Enumeration

You are a penetration tester in the early phases of an engagement. You have identified a range of live hosts and need to enumerate services systematically.

**Port Scanning Strategy**
- What is the difference between TCP SYN, TCP connect, and UDP scanning?
- How do you balance scan speed against detection risk?
- What ports do you scan first: top 1000, top 100, or full 65535?
- How do you handle hosts that appear to have all ports filtered?

**Service Fingerprinting**
- Once a port is open, how do you determine the exact service and version?
- What does banner grabbing tell you and where does it fall short?
- How do you enumerate services when they are running on non-standard ports?

**Per-Service Enumeration**
- **SSH (22):** What version-based vulnerabilities are common? What authentication methods are enabled?
- **HTTP/HTTPS (80/443):** What is your web application enumeration starting point?
- **FTP (21):** How do you check for anonymous login and what do you look for?
- **SMTP (25):** How do you enumerate valid users via VRFY/EXPN?
- **SNMP (161/UDP):** What community strings do you try? What information does SNMP expose?
- **RPC/NFS:** What does rpcinfo reveal? How do you list NFS exports?

**Version Research**
- Given a service version string, how do you quickly find known CVEs?
- How do you distinguish between a real vulnerability and a false positive from a scanner?

Output:
- Priority port scanning order with rationale
- Per-service enumeration checklist
- Tool command reference (nmap, netcat, enum4linux, snmpwalk)