Scanning & Enumeration
Overview
Scanning identifies what's active and exposed on an authorized network; enumeration digs deeper into what those scans reveal.
Key concepts
- Open/closed/filtered ports
- Banner grabbing, service version detection
- False positives vs. false negatives
How it works
Scanning is the process of identifying active devices, ports, services, and potential weaknesses on an authorized network — helping testers understand what's exposed and what needs further review.
Enumeration goes a level deeper — gathering detailed information from discovered services and systems, potentially identifying usernames, groups, shares, software versions, directories, permissions, and service settings.
Port and service states
| Term | Meaning |
|---|---|
| Host discovery | Identifying devices that are active on a network. |
| Port | A numbered communication endpoint used by network services. |
| Open port | Accepting network connections. |
| Closed port | Reachable but not accepting connections. |
| Filtered port | Status can't be determined because a firewall or filter is blocking communication. |
| Service | A program that listens for connections and provides a network function. |
Identifying what's running
| Term | Meaning |
|---|---|
| Banner grabbing | Identifying service information provided by a system. |
| Service version detection | Determining the software and version running on an open service. |
| Vulnerability scan | An automated process checking systems for known vulnerabilities and insecure settings. |
| False positive | A result that incorrectly reports a vulnerability or security issue. |
| False negative | A result that fails to identify a real vulnerability or security issue. |