From Enumeration to Foothold

You finished phase 1 and you have a scan full of open ports. A pile of findings is not a foothold. This lesson is about the bridge: how to interrogate each service, decide what is worth chasing, and turn one weak spot into a shell.

Enumerate each service on its own terms

An open port is a door. What you do next depends entirely on what is behind it. Take every port your scan reported and ask the questions that service answers to.

• 80 / 443 (HTTP). Read the page source. Fingerprint the tech. Brute-force directories and virtual hosts. Web is the most common foothold, so spend time here.
• 22 (SSH). Rarely the way in by itself, but note the version and hold any usernames you find for a later credential attempt.
• 445 (SMB). List shares as a null or guest user. Anonymous shares leak configs, backups, and credentials constantly.
• 3306 / 5432 (databases). Try default and reused credentials. A readable database often holds password hashes.

GET /api/users/1 HTTP/1.1
Host: target.example.com

Prioritize: what actually gives a shell

Not every finding is worth your time. Rank them by how directly they lead to code execution. A file-upload form that accepts a .php file outranks a cosmetic version banner. A world-readable share with a config file outranks an SSH port with no creds. Chase the finding that most plausibly ends in a shell, and park the rest in your notes.

Land the shell

A foothold is the moment a service runs your command. The cleanest proof is a reverse shell: you open a listener, then trick the target into connecting back to you. Start the listener first, always, or the callback lands on nothing.