Reconnaissance & Enumeration

Start broad, then go deep. A typical flow: an Nmap scan reveals open ports; each service is then enumerated individually. `nmap -sC -sV -p-` gives scripts, versions and all ports.

Web services deserve the most attention: directory brute-forcing, examining source and headers, testing input fields. SMB, FTP, and databases frequently allow anonymous or default-credential access.

Keep meticulous notes. Every credential, version number and hostname is a potential pivot. Professional testers maintain a running "loot" file per engagement.

The skill that separates beginners from pros is patience during enumeration. Most failed boxes are not un-hackable; the finding was simply missed because enumeration stopped too early.