Skip to main content

Network Services

Offensive and defensive reference for core network services: DNS, DHCP, NTP, SNMP, LDAP, Kerberos, and common auxiliary services (SMTP relay, NFS, SMB host-level, Rsync, FTP). This subcategory covers the services themselves and their protocol-level attacks; Active Directory-specific Kerberos/LDAP attacks live in 01 Active Directory.

This subcategory uses the two-track format (Offensive / Defensive). See the parent INFRASTRUCTURE README for the format skeleton.

Files​

#FileFocus
01DNSZones, records, zone transfer, cache poisoning, DNSSEC
02DHCP and NTPRogue DHCP, DHCP spoofing, NTP amplification, time attacks
03SNMPCommunity strings, MIB walking, RCE via SNMP, SNMPv3
04LDAP and KerberosAnonymous bind, LDAP injection, Kerberos service enum, AS-REP/Kerberoast (host-level)
05Other ServicesSMTP relay, NFS, SMB (host-level), Rsync, FTP

Scope​

In scope:

  • DNS servers (BIND, Windows DNS, dnsmasq, PowerDNS, CoreDNS).
  • DHCP servers (ISC DHCP, Windows DHCP, dnsmasq).
  • NTP servers (ntpd, chrony, Windows Time).
  • SNMP agents (net-snmp, Windows SNMP).
  • LDAP directories (OpenLDAP, 389 Directory Server, Active Directory).
  • Kerberos KDCs (MIT Kerberos, Heimdal, Active Directory).
  • Auxiliary services: SMTP relay, NFS, SMB (host-level), Rsync, FTP.

Out of scope:

  • Active Directory domain attacks (Kerberoasting, DCSync, trusts) - see 01 Active Directory.
  • Web application attacks on services - see APPLICATIONS.
  • Cloud-managed services (Route 53, Azure DNS) - see the CLOUD category.