# Enumeration

> Grab banners, versions, and NTLM info from Telnet services

- **URL:** https://hackindex.io/services/telnet/enumeration
- **Service:** [Telnet](https://hackindex.io/services/telnet.md)
- **Tags:** services, users, endpoints
- **Published:** 2026-01-03
- **Updated:** 2026-03-29

Telnet enumeration is straightforward but often reveals more than expected. Banner grabbing on port 23 (and alternate ports like 2323 or 9999) returns the service name, OS details, and sometimes the device model and firmware version. Network devices, embedded systems, and legacy servers frequently expose detailed identification strings before any authentication.

Login prompt analysis tells you what kind of system you are dealing with. A Cisco IOS prompt, a Linux login banner, or a custom application prompt each suggest different default credential sets and attack approaches. Some Telnet services present menu-driven interfaces that leak functionality information before authentication.

Nmap's telnet-ntlm-info script extracts NTLM information from Windows Telnet services when available. For embedded devices and IoT, Telnet is often the primary management interface with minimal security, making enumeration and exploitation nearly simultaneous.

## Guides

- [Telnet Banner and Service Enumeration](https://hackindex.io/services/telnet/enumeration/telnet-banner-and-service-enumeration.md)