Definition: The most critical phase. The goal is not immediate access, but identifying all possible attack vectors.
We narrow our search to two main points, usually exposed by misconfigurations or neglect:
Testers often fail not because they missed a tool, but because they lack deep knowledge of the service. Investing time to learn how a specific service works often saves hours of aimless scanning.
Manual vs. AutomatedManual enumeration is mandatory.
- Tool Limitations: Scanners (like Nmap) rely on timeouts. If a service is slow to respond, the tool may mark a port as "Closed" when it is actually open.
- The Risk: Relying 100% on automation can cause you to miss the one open door you needed.