Enum Cheklist

🧠 Initial Enumeration Checklist

🔍 Basic Discovery

• Target IP Address & Hostname

• Host Discovery (Are They Alive?)

• Ping Sweeps

• ARP Scans

• Traceroute

• Network Mapping

🔌 Port Scanning

• TCP Connect Scans

• SYN Scans

• UDP Scans

• Specific Port Scans

• Version Detection

• Script Scanning

🌐 Service Enumeration

• Banner Grabbing

• SNMP Enumeration

• SMB Enumeration

• SMTP Enumeration

• SSH Enumeration

• HTTP Enumeration

• Database Enumeration (MySQL, Postgres, MSSQL)

• LDAP Enumeration

• RPC Enumeration

• RDP Enumeration

• VNC Enumeration

• Network Share Enumeration

• Printer Enumeration

• SCADA Enumeration

• Hardware Enumeration

🖥 Operating System Detection

• Nmap OS Detection

• TTL Analysis

• SMB OS Detection

🚨 Vulnerability Scanning

• Nessus

• OpenVAS

• Nikto

• Nmap NSE Scripts

• Manual Vulnerability Checks

👤 User Enumeration

• Brute-force

• Default Credentials Checks

• Social Engineering

🕸 Web Enumeration

• Web Server Detection & Web Enumeration

• CMS Enumeration (WordPress, Joomla, Drupal)

• Version Control System Enumeration

• Websocket Enumeration

• GraphQL Enumeration

• Source Page Analysis (Comments, JS, API Keys, etc.)

• CORS Configuration

• Frameworks/Technologies Detection (Wappalyzer, WhatWeb, BuiltWith)

• Burp Suite Headers Analysis

• HTML Tags Analysis

🌐 DNS Enumeration

• DNS Lookups

• Zone Transfers

• Subdomain Enumeration

• Reverse DNS Lookup

• DNS Brute Forcing

🌍 WHOIS and Certificate Data

• WHOIS Information

• SSL/TLS Certificate Inspection

• Certificate Enumeration

☁️ Cloud Enumeration

• AWS S3 Bucket Enumeration

• Azure Blob Storage Enumeration

• Google Cloud Storage Enumeration

📱 Mobile/IoT Enumeration

• APK/IPA Analysis

• Mobile API Enumeration

• Bluetooth Enumeration

• Firmware Analysis

🔎 External Intelligence

• Shodan

• Censys

• Code Repository Enumeration

🧱 Infrastructure Components

• Firewall Enumeration

• VPN Enumeration

• Load Balancer Enumeration

• IDS/IPS Enumeration

📦 Container & Virtualization

• Container Enumeration (Docker, Kubernetes)

⚙️ Misc

• Running Automated Recon Tools

• Notes & Observations (Errors, Hidden Params, etc.)