From detecting a service to identifying resources
Enumeration uses protocol responses within authorized scope to identify named resources or attributes, such as shares, directory entries or service capabilities. A port state describes the probe’s observation; it has not listed those objects.
SMB supports network file sharing and related functions. TCP 445 is commonly associated with SMB, but a port number still needs service and response confirmation. The service may require authentication, and visible resources or permitted actions can differ by account.
Further reading: Microsoft: SMB file sharing overview·Nmap: Port Scanning Basics
A response is conditional evidence
If the service returns shares=[public, reports], report that it returned two share names at that time for that identity. Without testing authorized read or write operations, do not claim those permissions or administrator access.
Access denied means that request was rejected; it does not prove no shares exist. An empty list also needs identity, filters and response status because it may describe only what that identity can see. Separate returned names, verified permissions and unknowns in the report.
Example: three different evidence cards
Card A says 445/tcp open. Card B says SMB negotiation successful. Card C says authenticated user=lab-reader, shares=[public, reports]. All three describe a fictional environment.
A supports a port-state observation. B adds protocol interaction evidence. C supplies named resources. Even with C, read and write permissions remain separate questions.
Conclusion: Record C as share enumeration for that identity, leaving read and write capability unknown.
Tabletop exercise: build an enumeration evidence table
Use only cards A, B and C and the synthetic access-denied response. Do not connect to an SMB host.
- Create columns for observation, identity, supported conclusion and unknowns.
- Add one row per response; explicitly mark missing identity unknown.
- Write a report sentence for C without unsupported claims such as full control.
Expected result
Only C provides share names. B supports service interaction. Access denied does not establish resource absence.
Check your work
If C lists reports, can you claim it is writable? Identify the missing verification.
Finish and clean up
Keep the table as your learning artifact. No login or network cleanup is needed.