6.2 DNS, Directory, Share, and Account Enumeration

Once host, service, OS, and protocol facts exist, PT0-003 still expects you to enumerate names and access. Objective 2.2 lists DNS enumeration, directory enumeration, share enumeration, local user enumeration, and email account enumeration as separate techniques. They often run against the same Windows Server 2019 box you just fingerprinted, but they answer different questions. DNS tells you what else the organization named. Directories tell you how objects are organized. Shares tell you which folders a guest or an authenticated user can see. Accounts tell you who exists — locally, in the directory, or as a mailbox.

DNS enumeration is more than a lookup

Objective 2.1 already covers DNS lookups and reverse lookups as information gathering. DNS enumeration on 2.2 is the deeper pass: what else does this zone reveal? You collect record types, not a single A record. A and AAAA map names to IPv4 and IPv6. MX shows the mail path, often a different security domain than the website. NS and SOA identify who answers authoritatively. TXT holds Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) policy — and, on a bad day, leftover cloud-verification tokens. CNAME aliases can point at a vendor you did not think was in scope (still a lead, not automatic authorization). PTR reverse records name hosts that forward DNS never advertised. SRV records are gold in Microsoft shops: _ldap._tcp.dc._msdcs.example.com locates domain controllers without a port scan.

Two misconfigurations turn DNS from a lookup into a dump. A zone transfer (AXFR) against a name server that allows it returns the full zone — every name the administrator published. Zone walking uses DNS Security Extensions (DNSSEC) NSEC or NSEC3 records, which were meant to prove that a name does not exist, to walk from one name to the next. Subdomain brute force tries likely labels (vpn, staging, dev, mail, origin) against the zone. That is still enumeration of the naming system, not OSINT scraping of social media. Exam trap: stopping after www.example.com resolves. The 2.2 item wants the extra records, the transfer attempt, or the brute-force pass.

Directory enumeration: LDAP and web paths

Directory enumeration has two exam meanings, and stems use both. In an identity directory, you enumerate Lightweight Directory Access Protocol (LDAP) or Active Directory (AD) naming contexts, users, groups, computers, and organizational units. An anonymous or low-privilege bind that returns the default naming context is already a finding. Distinguished names, group membership, and service principal names (SPNs) are inventory at this stage — you are mapping what the directory contains, not yet forging tickets.

On a web server, directory enumeration means learning which paths exist: an enabled directory listing, leftover /backup/, /admin/, /server-status, or an application that exposes predictable folders. Directory brute-force tools belong with the later recon-tools chapter; here you need the decision: listing or guessing web directories is 2.2 directory enumeration, and it stays inside the named URL or host in the statement of work. Wandering onto a content delivery network origin because it appeared in HTML is not "directory enum" — it is a scope problem.

Share enumeration: SMB and NFS, guest versus authenticated

Share enumeration lists file exports and the access model. On SMB you ask: which shares exist, and can a null session or guest account see them without a real password? IPC$ is the inter-process pipe share used for named-pipe RPC; it often requires a login even when a data share does not. Administrative shares such as C$ and ADMIN$ are not "more SMB" — they are authenticated, high-value targets you record but do not browse past authorization. On Network File System (NFS) you enumerate exported paths and whether the export is world-readable or restricted by client address. Anonymous File Transfer Protocol (FTP) is the same idea on a different protocol: a list of folders a stranger can see.

Worked example: guest share IT-ARCHIVE

Return to 10.4.12.8, Windows Server 2019, 445 open, signing not required. Share enumeration with no credentials lists a guest-accessible folder named IT-ARCHIVE while IPC$ still demands a login. That distinction is the finding. Guest-readable archives are where backup catalogs, old configuration exports, and forgotten credential files live. You have not opened a ransomware path. You have named a data store that later attack-path mapping will connect to a service account.

Local user enumeration

Local user enumeration collects account names and attributes on a host or in a domain. On Windows, testers use Security Account Manager Remote (SAMR) and related RPC calls, including relative identifier (RID) cycling as an identification technique: well-known RID 500 is the built-in Administrator, 501 is Guest, and incrementing RIDs reveals which accounts exist. That is name discovery, not a password attack. LDAP queries against AD return sAMAccountName, description, last logon, and group membership when the bind allows it. On Linux, /etc/passwd — if obtained from a misconfigured share, an over-broad NFS export, or another authorized file read — lists local users even when password hashes sit in /etc/shadow.

Description fields matter. Continuing the worked example, a user named backup_svc has a description that says it runs overnight restores from IT-ARCHIVE. That sentence is enumeration gold: it ties a service account to a guest-readable share. You record the name, the description, and the group membership if you have it. You do not treat the description as a license to guess passwords in a public chat, and you do not skip documentation because "it is only a description."

Email account enumeration

Email account enumeration asks which mailboxes exist, not which local RIDs exist. Classic SMTP oracles are VRFY, EXPN, and RCPT TO responses that differ for valid versus invalid recipients. Web applications leak the same fact through password-reset wording ("no such user" versus "if that account exists, we sent mail") and through login timing. Staff directories and harvested addresses are recon-adjacent; on 2.2, the exam still wants you to recognize an email-enum technique when the stem shows SMTP replies or a reset oracle. A SAMR listing of backup_svc with no @ mailbox is local user enumeration. A mail server that confirms j.smith@example.com is email-account enumeration. Do not collapse them.

Keep these five inventories separate on the exam even when one host produces all of them. The Windows file server can yield unsigned SMB, a guest share, a service account, and an MX record that points at a different mail farm. Each row in the table is a different 2.2 bullet and a different line in the notes you will later connect as a path.