OSCP · Module 3
Active Information Gathering
Map open ports and services with Nmap, then enumerate DNS, SMB, SNMP, and SMTP to identify the attack surface before moving to exploitation.
~2 h 18 resources Last updated September 25, 2026
Active information gathering sends traffic directly to the target. Port scanning with Nmap discovers what is running, and protocol-specific enumeration extracts users, shares, credentials, and configuration from each open service. This is where the bulk of your reconnaissance time goes. Rushing past enumeration into exploitation is the most common reason people get stuck.
Port Scanning and Service Detection
Nmap is the starting point for every target. Fast scan on common ports first, then full 65535 TCP scan to catch non-standard ports. UDP scanning is slower but catches SNMP, TFTP, and DNS. NSE scripts automate banner grabs and basic vulnerability checks in a single pass.
Service Enumeration
Each open port leads to protocol-specific enumeration. DNS zone transfers and subdomain brute-forcing map infrastructure. SMB null sessions expose shares, users, and password policies. SNMP with default community strings leaks system info and running processes. SMTP VRFY commands enumerate valid user accounts for credential attacks.
Notice
If you are stuck, enumerate harder. Thorough enumeration before exploitation is what separates a passing score from a failed attempt.
Read
The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.
-
Guide 4 min readDNS Record Enumeration
-
Guide 4 min readDNS Zone Transfer (AXFR)
-
Guide 1 min readReverse DNS Lookup Sweeps
-
Guide 5 min readSNMP Community String Brute Forcing