Network service enumeration & attack

When it applies

Recon exposed non-web services. Each is its own attack surface: anonymous access, default/weak creds, known-CVE versions, and info leaks that feed the next step. (See recon-arsenal for the discovery arsenal; this is the exploit routing per service.)

Why it works

Internal-style services are frequently deployed with defaults, anonymous binds, or no auth because they were "not meant to be exposed". Version banners map straight to public exploits.