Who is this for?
→Penetration testers who want enumeration depth beyond nmap basics
→Security engineers preparing for network-layer assessments
→CTF players who want real protocol experience
→Anyone preparing for OSCP or eJPT network modules
Skills tested
✓SMB share enumeration and comment extraction
✓SNMP community string exploitation and OID walking
✓DNS zone transfer (AXFR) against a live nameserver
✓SMTP VRFY user enumeration
✓LDAP anonymous bind and directory search
✓NFS export mounting and file retrieval
✓RPC program enumeration via portmapper
✓IKE Vendor ID extraction with ike-scan
✓SIP User-Agent enumeration with svmap
✓Finger daemon .plan file retrieval
What the exam covers
▸NetBIOS workgroup enumeration leading to SMB share discovery
▸SNMP sysLocation containing flag and DNS hostname clue
▸DNS AXFR revealing TXT records on internal subdomains
▸SMTP VRFY leaking valid usernames for LDAP search
▸NFS world-readable export containing RPC program reference
▸Custom RPC stub responding with flag on direct connection
▸IKE Vendor ID payload containing flag string
▸SIP OPTIONS 200 OK with custom User-Agent flag
▸Finger .plan file for user ghost
▸Final flag assembled from three protocol chain fragments
COMPLETELY FREE
Ready to get certified?
VPN-based lab. Enumerate twelve real network services. Request access and get your personal VPN config.
Free. VPN included. Email confirmation on approval.