Skip to content
HackIndex logo

HackIndex

Windows Network Enumeration

2 min read Jul 14, 2026

Network enumeration from a Windows target maps the local network configuration, firewall rules, and reachable hosts. This runs before exploitation to understand what is accessible, and after gaining access to identify pivot points and internal services not visible from outside.

Network configuration

PS C:\Users\Guest\Desktop> # All interfaces with IPs, MACs, DNS
PS C:\Users\Guest\Desktop> ipconfig /all
 
PS C:\Users\Guest\Desktop> # Routing table
PS C:\Users\Guest\Desktop> route print
 
PS C:\Users\Guest\Desktop> # ARP cache — recently contacted hosts
PS C:\Users\Guest\Desktop> arp -a
 
PS C:\Users\Guest\Desktop> # DNS cache — recently resolved names
PS C:\Users\Guest\Desktop> ipconfig /displaydns
 
PS C:\Users\Guest\Desktop> # PowerShell
PS C:\Users\Guest\Desktop> Get-NetIPAddress | Select-Object InterfaceAlias, IPAddress, PrefixLength
PS C:\Users\Guest\Desktop> Get-NetRoute | Select-Object DestinationPrefix, NextHop, InterfaceAlias
PS C:\Users\Guest\Desktop> Get-DnsClientCache | Select-Object Entry, Data

Active connections and listening ports

PS C:\Users\Guest\Desktop> # All connections with PIDs
PS C:\Users\Guest\Desktop> netstat -ano
 
PS C:\Users\Guest\Desktop> # Listening services only
PS C:\Users\Guest\Desktop> netstat -ano | findstr LISTENING
 
PS C:\Users\Guest\Desktop> # Match PIDs to process names
PS C:\Users\Guest\Desktop> netstat -anob
 
PS C:\Users\Guest\Desktop> # PowerShell
PS C:\Users\Guest\Desktop> Get-NetTCPConnection | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess | Sort-Object State
 
PS C:\Users\Guest\Desktop> # Find process name from PID
PS C:\Users\Guest\Desktop> Get-NetTCPConnection | Where-Object {$_.State -eq 'Listen'} | ForEach-Object {
$proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
[PSCustomObject]@{Port=$_.LocalPort; Process=$proc.Name; PID=$_.OwningProcess}
} | Sort-Object Port

Firewall rules

Firewall enumeration reveals which ports are blocked outbound and what inbound rules exist. This determines which exfiltration channels and reverse shell protocols are viable.

PS C:\Users\Guest\Desktop> # Firewall state per profile
PS C:\Users\Guest\Desktop> netsh advfirewall show allprofiles state
 
PS C:\Users\Guest\Desktop> # All inbound rules
PS C:\Users\Guest\Desktop> netsh advfirewall firewall show rule name=all dir=in
 
PS C:\Users\Guest\Desktop> # All outbound rules
PS C:\Users\Guest\Desktop> netsh advfirewall firewall show rule name=all dir=out
 
PS C:\Users\Guest\Desktop> # PowerShell
PS C:\Users\Guest\Desktop> Get-NetFirewallRule | Where-Object {$_.Enabled -eq 'True'} | Select-Object DisplayName, Direction, Action, Profile
 
PS C:\Users\Guest\Desktop> # Find rules allowing inbound connections
PS C:\Users\Guest\Desktop> Get-NetFirewallRule | Where-Object {$_.Direction -eq 'Inbound' -and $_.Action -eq 'Allow' -and $_.Enabled -eq 'True'} | Select-Object DisplayName, Profile

Hosts file and DNS configuration

PS C:\Users\Guest\Desktop> # Hosts file — custom name resolution, may reveal internal hostnames
PS C:\Users\Guest\Desktop> type C:\Windows\System32\drivers\etc\hosts
 
PS C:\Users\Guest\Desktop> # Configured DNS servers
PS C:\Users\Guest\Desktop> Get-DnsClientServerAddress | Select-Object InterfaceAlias, ServerAddresses
 
PS C:\Users\Guest\Desktop> # DNS search suffixes
PS C:\Users\Guest\Desktop> Get-DnsClient | Select-Object InterfaceAlias, ConnectionSpecificSuffix

Network shares

PS C:\Users\Guest\Desktop> # Local shares
PS C:\Users\Guest\Desktop> net share
PS C:\Users\Guest\Desktop> Get-SmbShare
 
PS C:\Users\Guest\Desktop> # Mapped network drives
PS C:\Users\Guest\Desktop> net use
PS C:\Users\Guest\Desktop> Get-PSDrive -PSProvider FileSystem | Where-Object {$_.Root -like '\\*'}
 
PS C:\Users\Guest\Desktop> # Connected sessions to this host
PS C:\Users\Guest\Desktop> net session
PS C:\Users\Guest\Desktop> Get-SmbSession