From the course: Certified Ethical Hacker (CEH)

Unlock this course with a free trial

Join today to access over 24,900 courses taught by industry experts.

Surveying enumeration countermeasures

Surveying enumeration countermeasures

From the course: Certified Ethical Hacker (CEH)

Start my 1-month free trial Buy for my team

Surveying enumeration countermeasures

“

- When it comes to protecting yourself against enumeration attempts, it's a delicate balance between hindering the protocol for its actual use. Like LDAP, we actually need to use LDAP. So you can't handicap the protocol too much because then it's not going to work. So if we take a look at some of these things independently, we can come up with some countermeasures for them, such as an email, silently ignore unknown recipients. There's no reason to tell someone that the root account does not exist or the root account does exist. If I tell you that the account doesn't exist, what that means is that if I don't receive an account that doesn't exist, then therefore it must exist. If I send an email to nick@example.com and I get back, user does not exist, and then I send an email to susan@example.com, I don't get that same result, Susan exists. So now I have a username. And then I do my brute force, try to determine the password just by guessing or you know, whatever. Disabled relay for…

Contents