0.8 Choose an enumeration toolkit
Main index · Tools by task · Attack Strategy Map
Build on established collectors: AutoRecon for network/service orchestration, PEASS for local hosts, and SharpHound/BloodHound Community Edition for AD relationships. Keep the existing procedures beside their output to interpret findings and validate prerequisites. A collector completing does not establish a complete attack surface or practical competence.
The current working procedures and replacement boundaries live inside the network, Linux, Windows and AD collection pages. Select alternatives for missing information rather than running the whole list. AutoRecon replaces routine wrapper orchestration; pspy adds live observation; Seatbelt retains focused artifact checks; PrivescCheck is an alternative/second opinion. Native helpers remain fallbacks or focused gap checks. Manual validation, authenticated contexts and host/session collection remain separate where required.
0.8.1 Select by current access
| Starting position | Collector | Combined coverage | Missing decision to validate |
|---|---|---|---|
| Explicit host/IP scope before a foothold | AutoRecon | Port/service discovery, service-specific plugins, saved commands/results and reports | Selected plugins, scan coverage, virtual-host/session context and exploitation prerequisites |
| SMB/RPC with anonymous or known identity | enum4linux-ng | Users/groups, domain/OS context, shares, policy and supported SMB/RPC reads; JSON/YAML | Identity context, denied reads, file contents and effective authorization |
| Linux shell | linPEAS | Host, permission, service, scheduled-execution and credential-location checks | Exact permission, privileged consumer, trigger and resulting identity |
| Linux shell with a suspected recurring consumer | pspy | Process observation, including command lines and periodic privileged consumers, without requiring root | Sufficient observation time, controllable path and usable trigger |
| Windows shell | winPEAS | Host/user context, services, tasks, permissions and credential-location clues; optional domain checks | Correct build/platform and manually verified conditions in the current token |
| Windows shell needing another configuration/permission view | PrivescCheck | Privilege-escalation/configuration checks with TXT/HTML reports | Baseline versus extended/audit/risky behavior; validate the decisive condition |
| Domain identity with a working collection context | SharpHound + BloodHound CE | Objects, groups, ACLs, delegation/trusts and selected host/session relationships | Compatible collector/CE versions, target scope, volatile sessions and each useful graph edge |
| Domain identity from Kali, needing readable LDAP inventory | ldapdomaindump | Users/groups/computers/trusts in HTML/JSON/greppable output | Attribute visibility, effective permissions, credentials and reachable authorized services |
| Newly found credentials and selected reachable hosts/services | NetExec | Protocol-specific authentication and selected share/user/group/session inventory | Domain versus local identity, service authorization and rights required by each enumeration; no automatic dumping/execution modules |
These are on-demand CLIs, supplementing existing manual Nmap/SMB/LDAP/host checks, with zero persistent MCP definitions. Less typing and fewer context switches are expected benefits, not measured speed/coverage guarantees. This guide installs nothing and executes no target commands.
0.8.2 Preferred orchestration base: AutoRecon
AutoRecon exposes plugin selection and preserves the underlying commands/results. Keep its orchestration/report structure and configure reviewed plugins rather than rewriting its scanner. The current repository is AutoRecon/AutoRecon; older Tib3rius links redirect there.
Review automatic run methods separately from generated manual suggestions. In the inspected source, SMB brute-force and ODAT suggestions are manual commands. Conversely, the optional SMB vulnerability plugin actually runs smb-vuln-* with unsafe=1. Do not enable it wholesale. HTTP/MSSQL Nmap plugins use broad script expressions, and directory discovery can follow redirects; inspect concrete behavior and scope. A safe tag is an author label, not exam approval.
Source checks: SMB vulnerability plugin, HTTP Nmap plugin, MSSQL Nmap plugin, manual SMB suggestions.
Use the plugin controls to select reviewed behavior and retain expanded commands. Explicit plugin lists force inclusion but other default-tagged plugins can still match: the working profile excludes the default tag, then explicitly selects its port/service/report plugins. Inspect executed command records rather than assuming a list alone is restrictive. Keep full TCP discovery distinct from service detection and partial top-100 UDP coverage. Review redirects/discovered names before more connections. The discovery and service procedures remain the validation baseline.
Direct use: The owning working-note pages provide direct collector commands and the inline AutoRecon configuration. Select options for the actual task rather than copying wrapper bookkeeping or running every tool. These direct commands use the installed upstream versions and their native reports; source hashes, plugin staging and custom run manifests from the older launchers are not implicit features. Native AD/host collectors remain useful focused fallbacks. No all-default invocation or full upstream feature set is designated exam-approved.
0.8.3 Host and AD collectors
The linPEAS builder can select checks; release builds contain broad coverage. Retain the output and validate highlighted leads with the Linux escalation procedure. Use pspy when the missing evidence is a recurring privileged consumer, rather than repeatedly rerunning static checks.
winPEAS distinguishes normal checks, optional domain collection and extra features. Its optional -vulnpackages sends package names/versions to an online lookup: exclude that from an offline exam-evidence workflow. Optional WSL/linPEAS download execution and external lookups need separate review. PrivescCheck provides readable reports and separate extended/audit/risky categories; an EDR/noise label is not itself an exam-permission category. Validate with the Windows escalation procedure.
For AD, use the SharpHound version supported by the deployed Community Edition. Begin with appropriate directory collection, then use focused host/session collection only where scope and evidence justify it. The domain-mapping procedure owns these variants. enum4linux-ng supplies the SMB/RPC view; ldapdomaindump supplies a readable LDAP inventory. The latter's --minimal reduces retained attributes, while optional hostname resolution needs scope review. Its old BloodHound conversion targets obsolete 1.x formats, not a current CE graph.
Our native helper stays a fallback and interpretation bridge. Expand upstream configuration and links before expanding it into another PEASS. Check the actual upstream licenses before redistributing a combined package; PEASS includes GPL-based terms and integration clarifications. Do not bulk-copy scanners into a new bundle.
0.8.4 Other bases assessed
| Candidate | Assessment |
|---|---|
| yaldobaoth/OSCP-Scripts | Useful convenience wrappers and workflow ideas, not a broad enumeration engine. Its AD wrapper also performs roasting; its psexec wrapper generates/executes a shell. The installer changes shell PATH and sudo secure_path. No LICENSE file was found in the inspected tree; review reuse permissions and each script before adopting the collection. |
| nmapAutomator | A smaller Bash alternative for staged scans and recon suggestions. Its vulnerability modes use broad vuln/vulners selections; do not adopt All as an exam profile. Inspected source is older than current AutoRecon, which alone does not prove breakage. |
| linWinPwn | Broad AD wrapper with enumeration and explicit attack operations. It documents an enumeration-only automatic mode, but discovery can still span servers and active checks. Keep it as an optional, separately audited configuration rather than an unattended default. |
The example repository uses an ordinary windows/x64/shell_reverse_tcp payload, not Meterpreter. msfvenom alone does not imply the restricted Metasploit/Meterpreter target allowance was consumed; the complete wrapper still needs feature-specific review. Function names and OSCP branding do not establish permission.
0.8.5 Policy and use boundaries
After new credentials, repeat the relevant directory/group/host-access collection using the new identity. After a new route, use the same network/service collectors against explicit reachable scope through the verified transport; do not assume raw SYN/UDP behavior works through every SOCKS proxy. The lateral-movement and pivoting procedures own the access and route checks. No automatic collector chooses the exploitation path or replaces the evidence/reporting workflow.
The exam guide and FAQ control restricted actions. Automated enumeration is distinct from automatic exploitation; wrappers inherit the restrictions of the features they actually run. No named OffSec approval is claimed. Keep environment-specific integration evidence private; a working collector does not establish exploitability, complete coverage or permission to use every optional feature.
Use explicit scope, controlled local evidence, compatible versions and manually verified leads. During concept study, inspect saved/synthetic output and the owning procedures; target-based execution remains for the later practice phase.