Ethical › Module 4 › Lesson 1
Enumeration vs Scanning
Scanning finds doors. Enumeration asks the service who it is — still needs permission.
Visual · enum_vs_scan
Scanning finds which doors are open. Enumeration knocks, reads the nameplate, and still requires the same written permission as the scan.
Opening
An open port is a door. Enumeration is reading the nameplate — still not a license to wander the building.
Module 3 (and Topic 7 before it) taught a connect scan on a host you are allowed to touch: hardcoded 127.0.0.1, a tiny port list, OPEN meaning the TCP handshake completed. That answer is binary. Port 8000 is open or it is not. It does not tell you whether the listener is Python http.server, nginx, or a toy you wrote. It does not tell you a product version. It does not list users or shares. Enumeration is the next conversation: after the door is open, you ask the service who it is — a banner, a Server header, a protocol greeting — and you record what it volunteered. The ethics line does not move. Scanning a café /24 was already forbidden. Enumerating campus Active Directory, SMB against a neighbor, or banners on a random internet IP is the same unauthorized interaction with extra words. This module practices banners on a listener YOU started (python -m http.server or similar). You will not enum4linux a dorm. You will not spray RID cycles at a school domain. You will not treat “the port was open in Module 3” as consent to pull usernames. Next lesson names what HTTP, SSH, and SMB might reveal on a box you own, and why those strings are noisy. This lesson is the distinction: scan finds doors; enum asks who; both need permission; both belong in notes you lock.
1. Scanning recap: OPEN is a handshake, not an identity
A beginner TCP connect scan loops a small port list, calls connect_ex((host, port)), and records OPEN when the handshake completes. That is a network fact from your vantage point. It is not a product name. Firewalls can hide live services behind timeouts. Loopback still teaches the loop without touching anyone else. Topic 7 hardcoded HOST = "127.0.0.1" so a mistake was harder. Module 3 carried the same control: never café, never ISP, never school subnet, never “I will just try the /24.” If you do not remember that sentence, stop and reread it before you add a recv() after connect. Enumeration without the scan ethics is just a louder mistake.
OPEN on 127.0.0.1:8000 after you started python -m http.server is the expected reward for a lab, not a vulnerability write-up and not a reason to launch Metasploit. OPEN on a neighbor’s 445 is not a lab at all — it is someone else’s door. This course will never tell you to “confirm with a scan of the floor.” Notes from a scan belong in $HOME/cyberlium-lab with chmod 600: host (loopback), ports, OPEN or closed_or_filtered. They do not belong in a group chat as trophies. Enumeration notes will add a second column: what the service said. Two columns, one permission boundary.
2. Enumeration: the service talks after the handshake — still an interaction
Enumeration, in Cyberlium’s wording, is authorized collection of service identity and configuration clues that the listener is willing to send: HTTP status and Server header, an SSH version string, a protocol greeting. It is not “hacking the box.” It is not dumping SAM. It is not cracking. It is conversation with a process that already accepted TCP. Conversation is still traffic. Logs still record it. Unauthorized conversation is still unauthorized access in many places, even if you only read a banner and disconnected. “I only asked who it was” is not a legal theory this course will endorse.
The mechanism is simple enough to hold in one breath. After connect succeeds, some protocols send bytes first (SMTP, SSH, FTP greetings). HTTP usually waits for you to send a request; a HEAD or GET then returns headers including Server, Date, and sometimes extra product tokens. Reading those bytes is enumeration. Comparing them to a mental list of “this looks like Python http.server” is analysis. Neither step requires an exploit. Neither step is improved by pointing the same client at 445 on a host you do not own. If the connect fails, there is nothing to enumerate — write CLOSED and stop. Do not “try harder” with a different tool against a different IP.
3. Permission is the same object: RoE, ownership, or a lab you started
Rules of engagement (RoE) on a paid assessment name networks, hours, and forbidden techniques. You do not have RoE for the campus AD, the café gateway, or the ISP CPE. You do have ownership of 127.0.0.1 on a machine you control, and you have ownership of a VM you installed. Starting python -m http.server in $HOME/cyberlium-lab is you creating the target. Reading its banner is in scope because you created the listener. Copying the same curl -I onto a classmate’s laptop IP is out of scope even if they left port 8000 open “for the class.” Ask. Get it in writing. If you cannot, do not enum.
Active Directory enumeration — user lists, group membership, trusts, SMB shares on a domain you do not administer — is a professional technique under contract, not a homework target. This lesson will not walk NetBIOS name tables against neighbors. It will not give you a command line for ldapsearch at the university DC. If a blog titled “CEH enumeration commands” aims those tools at 10.0.0.0/8 “because labs,” that blog is not this course. Cyberlium’s authorized enum surface for Module 4 is: a listener you started, preferably HTTP on loopback, notes locked. Users and shares appear in the next lesson as literacy about what those protocols can leak on a box you own — not as a license to collect them elsewhere.
Command guide
Enumeration after handshake — WHAT/WHY (service talks)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
curl -sS -m 2 -I "http://127.0.0.1:8000/"
Command — copy this
cat >> "$NOTES" << 'EOF' scan: OPEN / closed_or_filtered (handshake) enum: headers/banner/shares AFTER handshake — still interaction permission: same RoE as Module 3 — 127.0.0.1 or MY VM EOF
4. What you record: two verbs, two columns, one ethics line
Scan column: host, port, OPEN or closed_or_filtered, timestamp, the exact command (connect_ex list or a single curl that only proved TCP). Enum column: the bytes or headers the service volunteered, truncated if huge, never including secrets you did not mean to put on the listener. Ethics line: “target is a service I started on 127.0.0.1; no campus AD; no neighbor SMB; no café.” Empty notes fail. Notes that list other people’s IPs fail ethics even if curl ran. chmod 600 so a shared account does not read your lab tree. You already practiced this path in Topics 2, 7, and 8. Enumeration does not get a sloppier folder.
A useful failure: you scan 127.0.0.1:8000, it is closed, and you have nothing to enum. That is a complete lab for this lesson’s distinction — write SCAN: closed; ENUM: not attempted. Starting the server is Lesson 4. Do not “find an open 8000 on the LAN” to skip ahead. Do not bind http.server to 0.0.0.0 on a shared network so classmates can enum you without asking; bind loopback if your Python allows it, or keep the lab on a machine that is not offering the port to the café. The teaching goal is the difference between door-finding and nameplate-reading, not a multiplayer banner contest.
5. Wrong vs right: campus AD / neighbor SMB vs a listener YOU started
Worked failure — same curl and same curiosity, opposite target. Right never treats an open port on someone else as a practice AD or a share list.
Wrong
Treat Module 3 OPEN results on a school subnet as consent to enumerate users, shares, and banners. Run SMB tooling against a neighbor, enum4linux against campus AD, or curl -I at a random internet IP “because the port is open.” Collect usernames into a world-readable file. Call the lesson complete only if you got a domain user list. Skip notes. Skip chmod. Call it research.
Right
Keep scan and enum as two verbs. Scan finds doors on 127.0.0.1 (or a VM you own). Enum reads identity from a service YOU started — HTTP headers are enough for this module. Write both columns plus the ethics line in $HOME/cyberlium-lab, chmod 600. No campus AD. No neighbor SMB. No café. Next: what banners can leak on a box you own, still without an SMB exploit.
6. Hands-on: write the two-column notes (scan vs enum), lock the file
On a computer you own, create cyberlium-lab if needed. Fill enum-vs-scan-notes.txt with definitions in your own words, a scan row for 127.0.0.1:8000 (OPEN or closed — both valid), and an enum row that is either “not attempted, no listener I started” or a short reminder that Lesson 2 will read Server headers. Do not pivot to a LAN IP if 8000 is closed. chmod 600. The optional Python below only talks to loopback and refuses any other host.
Command guide
Same permission object — WHAT/WHY then lock
═══ COMMANDS ═══
Command — copy this
test -f "$HOME/cyberlium-lab/ceh-roe.txt" && echo "RoE present — enum still inside it"
Mission: enum-vs-scan-notes.txt in cyberlium-lab (mode 600)
1) In your own words, define scanning (doors / TCP OPEN) versus enumeration (asking the service who it is). Write that permission is required for both. 2) Run the loopback check (or Test-NetConnection 127.0.0.1 -Port 8000). Fill the scan column. If closed, do not hunt another IP. chmod 600 script and notes under $HOME/cyberlium-lab. 3) Ethics line in the file: no campus AD, no neighbor SMB, no café, no random internet banners. Enumeration in this module is a service YOU started.
Stuck? Ask Cyberlium AI Mentor
If “open port means I may pull users and shares anywhere” still feels true, ask for a hint — not an AD command pack. Try: "Hint only: why scanning 127.0.0.1 finds doors while enumeration reads a nameplate, why both still need permission, and why campus AD and neighbor SMB are out of this lesson?" You still fill the notes. No enum4linux. No ldapsearch against a school. No LAN hunt when 8000 is closed.
You now hold two verbs that Module 3 collapsed into one curiosity: scanning records whether a handshake completed; enumeration records what the listener said afterward. Both are interactions. Both need ownership, RoE, or a service you started. Topic 7’s localhost scanner was the door-finder; this lesson named the nameplate. Next — Banners, Users, and Shares (Authorized Lab) — you will see what HTTP Server headers (and, as literacy, SSH/SMB on a box you own) can leak, why those strings are noisy, and why HTTP on localhost is enough. Still no SMB exploit. Still no campus AD.
Knowledge Check
APPLY: Module 3 showed 127.0.0.1:8000 OPEN after you started http.server. A classmate says OPEN on the campus file server means you should enumerate domain users tonight. What is enumeration here, and what do you do?
Multiple choice
Knowledge Check
APPLY: True or False: Scanning finds doors and enumeration asks who the service is, so if 8000 is closed on loopback you should banner-grab the café /24 until something answers.
True or False
Knowledge Check
APPLY: You are writing enum-vs-scan-notes.txt. Which pairing matches the mechanism and the ethics line?
Multiple choice
Knowledge Check
APPLY: curl of http://192.168.0.1/ shows a home router login (TP-Link / Netgear / Huawei / "Router Admin"). Is that DEMO in scope as a hacking target?
Multiple choice