Windows Network Enumeration
2 min read
Created Apr 4, 2026
Last updated Jul 14, 2026
Network enumeration from a Windows target maps the local network configuration, firewall rules, and reachable hosts. This runs at multiple stages:
Before exploitation, to understand what is accessible from outside
After gaining access, to identify pivot points and internal services
During lateral movement, to find new network segments and hosts
Focus on interfaces, active connections, firewall rules, and network shares.
Network configuration
PS C:\Users\Guest\Desktop> # All interfaces with IPs, MACs, DNS
PS C:\Users\Guest\Desktop> ipconfig /all
PS C:\Users\Guest\Desktop> # Routing table
PS C:\Users\Guest\Desktop> route print
PS C:\Users\Guest\Desktop> # ARP cache: recently contacted hosts
PS C:\Users\Guest\Desktop> arp -a
PS C:\Users\Guest\Desktop> # DNS cache: recently resolved names
PS C:\Users\Guest\Desktop> ipconfig /displaydns
PS C:\Users\Guest\Desktop> # PowerShell
PS C:\Users\Guest\Desktop> Get-NetIPAddress | Select-Object InterfaceAlias, IPAddress, PrefixLength
PS C:\Users\Guest\Desktop> Get-NetRoute | Select-Object DestinationPrefix, NextHop, InterfaceAlias
PS C:\Users\Guest\Desktop> Get-DnsClientCache | Select-Object Entry, Data
Active connections and listening ports
PS C:\Users\Guest\Desktop> # All connections with PIDs
PS C:\Users\Guest\Desktop> netstat -ano
PS C:\Users\Guest\Desktop> # Listening services only
PS C:\Users\Guest\Desktop> netstat -ano | findstr LISTENING
PS C:\Users\Guest\Desktop> # Match PIDs to process names
PS C:\Users\Guest\Desktop> netstat -anob
PS C:\Users\Guest\Desktop> # PowerShell
PS C:\Users\Guest\Desktop> Get-NetTCPConnection | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess | Sort-Object State
PS C:\Users\Guest\Desktop> # Find process name from PID
PS C:\Users\Guest\Desktop> Get-NetTCPConnection | Where-Object {$_.State -eq 'Listen'} | ForEach-Object {
$proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
[PSCustomObject]@{Port=$_.LocalPort; Process=$proc.Name; PID=$_.OwningProcess}
} | Sort-Object Port
Firewall rules
Firewall enumeration reveals which ports are blocked outbound and what inbound rules exist. This determines which exfiltration channels and reverse shell protocols are viable.
PS C:\Users\Guest\Desktop> # Firewall state per profile
PS C:\Users\Guest\Desktop> netsh advfirewall show allprofiles state
PS C:\Users\Guest\Desktop> # All inbound rules
PS C:\Users\Guest\Desktop> netsh advfirewall firewall show rule name=all dir=in
PS C:\Users\Guest\Desktop> # All outbound rules
PS C:\Users\Guest\Desktop> netsh advfirewall firewall show rule name=all dir=out
PS C:\Users\Guest\Desktop> # PowerShell
PS C:\Users\Guest\Desktop> Get-NetFirewallRule | Where-Object {$_.Enabled -eq 'True'} | Select-Object DisplayName, Direction, Action, Profile
PS C:\Users\Guest\Desktop> # Find rules allowing inbound connections
PS C:\Users\Guest\Desktop> Get-NetFirewallRule | Where-Object {$_.Direction -eq 'Inbound' -and $_.Action -eq 'Allow' -and $_.Enabled -eq 'True'} | Select-Object DisplayName, Profile
Hosts file and DNS configuration
PS C:\Users\Guest\Desktop> # Hosts file: custom name resolution, may reveal internal hostnames
PS C:\Users\Guest\Desktop> type C:\Windows\System32\drivers\etc\hosts
PS C:\Users\Guest\Desktop> # Configured DNS servers
PS C:\Users\Guest\Desktop> Get-DnsClientServerAddress | Select-Object InterfaceAlias, ServerAddresses
PS C:\Users\Guest\Desktop> # DNS search suffixes
PS C:\Users\Guest\Desktop> Get-DnsClient | Select-Object InterfaceAlias, ConnectionSpecificSuffix
Network shares
PS C:\Users\Guest\Desktop> # Local shares
PS C:\Users\Guest\Desktop> net share
PS C:\Users\Guest\Desktop> Get-SmbShare
PS C:\Users\Guest\Desktop> # Mapped network drives
PS C:\Users\Guest\Desktop> net use
PS C:\Users\Guest\Desktop> Get-PSDrive -PSProvider FileSystem | Where-Object {$_.Root -like '\\*'}
PS C:\Users\Guest\Desktop> # Connected sessions to this host
PS C:\Users\Guest\Desktop> net session
PS C:\Users\Guest\Desktop> Get-SmbSession