# Active Information Gathering

> Map open ports and services with Nmap, then enumerate DNS, SMB, SNMP, and SMTP to identify the attack surface before moving to exploitation.

- **URL:** https://hackindex.io/learn/oscp-pen-200-study-path/active-information-gathering
- **Certification:** [OSCP (PEN-200) Study Path](https://hackindex.io/learn/oscp-pen-200-study-path.md)
- **Estimated study hours:** 2
- **Published:** 2026-09-23
- **Updated:** 2026-09-25

Active information gathering sends traffic directly to the target. Port scanning with Nmap discovers what is running, and protocol-specific enumeration extracts users, shares, credentials, and configuration from each open service. This is where the bulk of your reconnaissance time goes. Rushing past enumeration into exploitation is the most common reason people get stuck.

## Port Scanning and Service Detection

Nmap is the starting point for every target. Fast scan on common ports first, then full 65535 TCP scan to catch non-standard ports. UDP scanning is slower but catches SNMP, TFTP, and DNS. NSE scripts automate banner grabs and basic vulnerability checks in a single pass.

## Service Enumeration

Each open port leads to protocol-specific enumeration. DNS zone transfers and subdomain brute-forcing map infrastructure. SMB null sessions expose shares, users, and password policies. SNMP with default community strings leaks system info and running processes. SMTP VRFY commands enumerate valid user accounts for credential attacks.

> [!NOTE]
> If you are stuck, enumerate harder. Thorough enumeration before exploitation is what separates a passing score from a failed attempt.

## Study material

- [Port Scanning with Nmap](https://hackindex.io/services/hosts/enumeration/port-scanning.md) (read, core)
- [Nmap Service Enumeration (NSE)](https://hackindex.io/services/hosts/enumeration/nmap-service-enumeration.md) (read, core)
- [OS Fingerprinting and Banner Grabbing](https://hackindex.io/services/hosts/enumeration/os-fingerprinting-and-banner-grabbing.md) (read, core)
- [ICMP Host Discovery and Ping Sweeps](https://hackindex.io/services/hosts/enumeration/icmp-host-discovery-and-ping-sweeps.md) (read, core)
- [DNS Record Enumeration](https://hackindex.io/services/dns/enumeration/dns-record-enumeration.md) (read, core)
- [DNS Zone Transfer (AXFR)](https://hackindex.io/services/dns/enumeration/dns-zone-transfer-axfr.md) (read, core)
- [Subdomain Brute Forcing](https://hackindex.io/services/dns/enumeration/subdomain-brute-forcing.md) (read, core)
- [Reverse DNS Lookup Sweeps](https://hackindex.io/services/dns/enumeration/reverse-dns-lookup-sweeps.md) (read, core)
- [SMB Share Enumeration](https://hackindex.io/services/smb/enumeration/smb-share-enumeration.md) (read, core)
- [SMB Null Session Enumeration](https://hackindex.io/services/smb/enumeration/smb-null-session-enumeration.md) (read, core)
- [SMB User and Domain Enumeration](https://hackindex.io/services/smb/enumeration/smb-user-and-domain-enumeration.md) (read, core)
- [SMB Host Security Enumeration](https://hackindex.io/services/smb/enumeration/smb-host-security-enumeration.md) (read, core)
- [SMTP enumeration](https://hackindex.io/services/smtp/enumeration/smtp-enumeration.md) (read, core)
- [SMTP User Enumeration](https://hackindex.io/services/smtp/vulnerability-discovery/smtp-user-enumeration.md) (read, core)
- [SNMP Community String Brute Forcing](https://hackindex.io/services/snmp/enumeration/snmp-community-string-brute-forcing.md) (read, core)
- [SNMP Broad System Enumeration](https://hackindex.io/services/snmp/enumeration/snmp-broad-system-enumeration.md) (read, core)
- [SNMP Targeted OID Enumeration](https://hackindex.io/services/snmp/enumeration/snmp-targeted-oid-enumeration.md) (read, core)
- [SNMP Default and Weak Community Strings](https://hackindex.io/services/snmp/vulnerability-discovery/snmp-default-and-weak-community-strings.md) (read, core)