RDP:
Enumeration
Fingerprint RDP via NTLM info, encryption levels, and TLS certs
RDP enumeration extracts configuration details that shape your attack approach. Nmap's rdp-enum-encryption and rdp-ntlm-info scripts reveal whether Network Level Authentication (NLA) is required, what encryption levels the server accepts, and NTLM information including the target hostname, domain name, and OS version.
Server certificates obtained during the TLS handshake leak hostnames, internal domain names, and certificate validity details. CredSSP configuration tells you whether the server enforces credential delegation protections or accepts downgraded connections.
Use rdp-sec-check to profile the full security posture: supported protocols (Standard RDP Security, TLS, CredSSP), encryption levels (Low, Client Compatible, High, FIPS), and NLA enforcement. This information determines whether brute-forcing is feasible, whether BlueKeep checks apply, and what relay or downgrade attacks are possible.