WinRM:
Enumeration
WinRM discovery, auth probing, cred validation, and config enum
WinRM enumeration starts with confirming the service is running and understanding its configuration. Port 5985 (HTTP) and 5986 (HTTPS) are the defaults, but WinRM can be configured on custom ports. Nmap service detection, banner grabbing, and HTTP response analysis confirm the presence and transport type.
Once detected, enumerate the authentication methods the endpoint accepts (Basic, Negotiate, Kerberos, CredSSP) and check the TrustedHosts configuration, which controls which clients can connect. CrackMapExec with the winrm protocol module quickly tests credential validity across multiple hosts without establishing a full session.
The subpages cover service detection techniques, authentication method enumeration, configuration inspection through accessible endpoints, and how to determine whether WinRM is configured permissively enough to be useful for further access.