Kali Linux 2018: Windows Penetration Testing - Second Edition

Using advanced Footprinting

Vulnerability scans only provide some information. When actually attacking the machine, you want to do some deep level probes to check for helpful information leaks. From the scans, we can see a Windows Domain Controller and a Windows File Server, both running Windows 2008 Server. Both have SMB/NetBIOS services running. This looks like the most likely path of attack. SMB/NetBIOS services have known weaknesses. So, let's look closer at these services.

Before we get fully into footprinting, a note about notes. Especially when getting into manual probes, remember to keep notes on your outputs and your findings. Copy/paste is your best friend. Vulnerability scans always produce nice reports, with the data all compiled ...