enum-services

name	enum-services
description	Run comprehensive service enumeration on a target including port scanning, version detection, and protocol-specific enumeration. Manually triggered via /pentester:enum-services or auto-suggested after target initialization.

Enumerate Services

This skill runs a comprehensive service enumeration workflow against a target, covering port scanning, service version detection, and protocol-specific enumeration.

When to Use

• After target initialization (Phase 0 complete, container ready)
• At the start of Phase 1 (Intelligence Gathering)
• User requests a service scan on a specific target
• Can be invoked manually via /pentester:enum-services

Prerequisites

• target/${IP}/ directory exists
• Docker container kali-target-${IP} is running
• Target is reachable from inside the container

Process

Step 1: Full Port Scan

Run comprehensive port scanning inside the container:

# TCP SYN scan — all ports
docker exec kali-target-${IP} nmap -sS -p- -T4 --min-rate=1000 -oN /tmp/tcp_full.txt ${IP}

# UDP top 20 ports
docker exec kali-target-${IP} nmap -sU --top-ports 20 -oN /tmp/udp_top20.txt ${IP}

Save results to target/${IP}/ports/tcp_full.txt and target/${IP}/ports/udp_top20.txt.

Step 2: Service Version Detection

Run version detection on discovered open ports:

# Extract open ports from TCP scan
PORTS=$(grep "open" /tmp/tcp_full.txt | cut -d'/' -f1 | tr '\n' ',' | sed 's/,$//')

# Version + OS detection on open ports
docker exec kali-target-${IP} nmap -sV -sC -O -p${PORTS} -oN /tmp/service_versions.txt ${IP}

Save to target/${IP}/ports/service_versions.txt.

Step 3: Protocol-Specific Enumeration

Based on discovered services, run targeted enumeration:

Port/Service	Tool	Command
80/443 (HTTP)	whatweb	whatweb ${IP}
80/443 (HTTP)	nikto	nikto -h http://${IP}
80/443 (HTTP)	gobuster	gobuster dir -u http://${IP} -w /usr/share/wordlists/dirb/common.txt
21 (FTP)	nmap	nmap --script=ftp-anon,ftp-bounce ${IP}
22 (SSH)	nmap	nmap --script=ssh2-enum-algos ${IP}
25 (SMTP)	nmap	nmap --script=smtp-commands,smtp-enum-users ${IP}
139/445 (SMB)	enum4linux	enum4linux -a ${IP}
139/445 (SMB)	smbclient	smbclient -L //${IP} -N
3306 (MySQL)	nmap	nmap --script=mysql-info,mysql-enum ${IP}
5432 (PostgreSQL)	nmap	nmap --script=pgsql-brute ${IP}

Save results to target/${IP}/services/${service_name}/.

Step 4: Generate Summary

Create target/${IP}/recon-summary.md with:

# Recon Summary: ${IP}

## Open Ports
| Port | Protocol | Service | Version |
|------|----------|---------|---------|
| 22   | TCP      | SSH     | OpenSSH 8.9 |
| 80   | TCP      | HTTP    | Apache 2.4.54 |
| ...  | ...      | ...     | ... |

## Key Findings
- [Notable service versions, potential vulnerabilities, misconfigurations]

## Next Steps
- [Recommended Phase 2/3 actions based on findings]

Sub-agent Opportunities

These tasks can run in parallel via sub-agents:

• TCP full scan + UDP top-ports scan (different nmap instances)
• Web enumeration (nikto + whatweb + gobuster) — after HTTP ports confirmed
• SMB + DNS + SMTP enumeration — after respective ports confirmed

Output

• target/${IP}/ports/ — all port scan results
• target/${IP}/services/ — per-service enumeration data
• target/${IP}/recon-summary.md — consolidated enumeration summary
• Inform user of key findings and suggest next phase actions