9.2.0 Stage 02: Service Enumeration

← Main index | Strategy map | Study methods: Extract opportunities from services; Map useful web behavior

Quick use: Service opportunity cheatsheet · Web mapping cheatsheet

Paired study stage: Stage 01 discovery and scanning. Enter with its endpoint/application queue; return when enumeration discloses a new in-scope host, listener, route or source position.

Purpose: turn a confirmed service into names, files, permissions, credentials, configuration clues or a verified remote-access path.

Applications may listen on nonstandard ports. Sort by the observed application behavior, not by the port label alone.

Exit condition: for each observed service, you can state the tested access context, available namespace or objects, effective read/write/execute rights, useful information recovered, decisive failure state and next action. A new identity, credential, hostname, route or access level triggers re-enumeration.

Handoffs: new network graph information returns to Stage 01; new credentials trigger authenticated re-enumeration and the credential unit; web behavior enters Blocks 3-4; a credible public exploit enters Block 6; verified execution enters Block 7.

Never equate a writable location with code execution. Confirm the privileged consumer, path, execution identity and trigger in the later exploitation or privilege-escalation stage.

• Memcached and WebDAV: cache data and WebDAV listing/write boundaries.