# Introduction

Since we covered enumerating ports during network enumeration in the previous chapter, let's now see how we can go a bit deeper and start *enumerating services* running on those ports.

Just finding open ports isn't enough — we need to know *what* is actually running behind those ports and how we can interact with them. That's where **service enumeration** comes in. It’s the process of gathering more detailed information about the services running on open ports — like the version, configuration, and any shared resources or weaknesses we might be able to exploit.

In this chapter, we’ll look at some commonly encountered services during penetration testing and CTF challenges:

* **SSH (Secure Shell)**
* **FTP (File Transfer Protocol)**
* **SMB (Server Message Block)**
* **MySQL (Database Service)**
* **NFS (Network File System)**

There are *thousands* of different network services out there, but we’re focusing on these six for a reason:\
They’re the ones you’ll most frequently encounter in real-world scenarios and beginner-to-intermediate level CTFs. Mastering enumeration techniques for these will give you a solid foundation. Once you're confident with these, branching out to others becomes much easier.

Understanding how to enumerate these services can help you:

* Discover hidden files, users, or configurations
* Identify weak credentials or misconfigurations
* Gather useful info that may lead to privilege escalation or lateral movement

***

## Lab Setup

* <mark style="color:yellow;">Download VM File from here</mark>: [CLICK ME](https://drive.google.com/file/d/10Ry0tk0_GF_NO_TtrKkG_Fg0Cz_S-gs2/view?usp=sharing)

Once imported add following entry in `/etc/hosts` file:

```bash
❯ cat /etc/hosts                        
127.0.0.1	localhost
127.0.1.1	dev

# The following lines are desirable for IPv6 capable hosts
::1     ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

# Additional Entry
192.168.10.163 enumlikeapro.nca
```

Also make sure it's bridged adapter.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://handbook.ncateam.xyz/reconnaissance/services-enumeration/introduction.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.