Windows Enumeration

📡 Passive Network Enumeration

🔸 Wireshark – Capture ARP / MDNS Traffic (GUI)

sudo -E wireshark

🔸 tcpdump – Capture Packets to a File

sudo tcpdump -i ens224 -w capture.pcap

🔸 tshark – Extract IPs from ARP Packets

tshark -r capture.pcap -Y "arp" | grep -oP "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}" | sort -u

🔸 Responder (Sniffing Only Mode, No Poisoning)

sudo responder -I ens224 -A

---

🚀 Active Network Enumeration

🔸 Host Discovery – Linux Tools

fping -asgq <range>
nmap -sn -n <range>

🔸 Host Discovery – Windows CMD

cmdCopyEditfor /L %i in (1,1,254) do ping 172.16.5.%i -n 1 -w 100 | find "Reply"

🔸 Host Discovery – PowerShell

powershellCopyEdit1..254 | % {"172.16.5.$($_): $(Test-Connection -count 1 -comp 172.15.5.$($_) -quiet)"}

---

📝 Default Writable Folders on Windows

textCopyEditC:\Windows\System32\Microsoft\Crypto\RSA\MachineKeys  
C:\Windows\System32\spool\drivers\color  
C:\Windows\System32\spool\printers  
C:\Windows\System32\spool\servers  
C:\Windows\tracing  
C:\Windows\Temp  
C:\Users\Public  
C:\Windows\Tasks  
C:\Windows\System32\tasks  
C:\Windows\SysWOW64\tasks  
C:\Windows\System32\tasks_migrated\microsoft\windows\pls\system  
C:\Windows\SysWOW64\tasks\microsoft\windows\pls\system  
C:\Windows\debug\wia  
C:\Windows\registration\crmlog  
C:\Windows\System32\com\dmp  
C:\Windows\SysWOW64\com\dmp  
C:\Windows\System32\fxstmp  
C:\Windows\SysWOW64\fxstmp