How do I install the Network Service Attacks skill?

Run npx skillmds@latest add noorqureshi/network-service-attacks in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Network Service Attacks safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Network Service Attacks?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Network Service Attacks free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Network Service Attacks?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Network Service Attacks by noorqureshi

Name: Network Service Attacks
Author: NoorQureshi

Network Service Attacks

Attack non-web network services surfaced by recon. Load when nmap shows services like SMB (445), RPC (135), LDAP (389), SNMP (161), NFS (2049), SMTP (25), FTP (21), RDP (3389), databases (3306/5432/1433/6379/27017). Signals: open non-HTTP ports, service+version banners.

NoorQureshi 2fe842a 2.2 KB Updated Sep 17, 2026

File contents

Network service enumeration & attack

When it applies

Recon exposed non-web services. Each is its own attack surface: anonymous access, default/weak creds, known-CVE versions, and info leaks that feed the next step. (See recon-arsenal for the discovery arsenal; this is the exploit routing per service.)

Why it works

Internal-style services are frequently deployed with defaults, anonymous binds, or no auth because they were "not meant to be exposed". Version banners map straight to public exploits.

Method

Always version-map first — the exact product+version is the fastest lead (nmap -sCV).
Route by service:
- SMB (445): nxc smb <ip> -u '' -p '' (null session), enum4linux-ng, list shares (smbclient -L //ip -N), check for EternalBlue/signing; spray creds with netexec.
- LDAP (389/636): anonymous bind dump (ldapsearch -x -H ldap://ip -b <base>) → users.
- SNMP (161): snmpwalk -v2c -c public ip — leaks processes, users, routes, sometimes creds.
- NFS (2049): showmount -e ip; mount world-readable exports, check no_root_squash.
- SMTP (25): VRFY/RCPT user enumeration.
- DBs: try default creds; Redis (6379) often unauth (→ web-ssrf-gopher-redis-rce if internal).
Map version → CVE: searchsploit <product version>; verify before firing.

Gotchas

Null/anonymous first — it's free and frequently works before any exploit.
SNMP community public/private and defaults are the quiet win people skip.
Confirm a CVE actually matches the exact version; wrong minor version = wasted exploit.

Verify success

Access or credentials from a service (share contents, LDAP users, a DB login), or confirmed exploitation of a versioned CVE — feeding foothold/privesc.

References

Service-enum references (HackTricks, 0xdf); netexec wiki; GTFOBins/searchsploit.

---name: network-service-attacksdescription: Attack non-web network services surfaced by recon. Load when nmap shows services like SMB (445), RPC (135), LDAP (389), SNMP (161), NFS (2049), SMTP (25), FTP (21), RDP (3389), databases (3306/5432/1433/6379/27017). Signals: open non-HTTP ports, service+version banners.---# Network service enumeration & attack## When it appliesRecon exposed non-web services. Each is its own attack surface: anonymous access, default/weakcreds, known-CVE versions, and info leaks that feed the next step. (See `recon-arsenal` for thediscovery arsenal; this is the exploit routing per service.)## Why it worksInternal-style services are frequently deployed with defaults, anonymous binds, or no authbecause they were "not meant to be exposed". Version banners map straight to public exploits.## Method1. **Always version-map first** — the exact product+version is the fastest lead (`nmap -sCV`).2. **Route by service**: - **SMB (445)**: `nxc smb <ip> -u '' -p ''` (null session), `enum4linux-ng`, list shares (`smbclient -L //ip -N`), check for `EternalBlue`/signing; spray creds with netexec. - **LDAP (389/636)**: anonymous bind dump (`ldapsearch -x -H ldap://ip -b <base>`) → users. - **SNMP (161)**: `snmpwalk -v2c -c public ip` — leaks processes, users, routes, sometimes creds. - **NFS (2049)**: `showmount -e ip`; mount world-readable exports, check `no_root_squash`. - **SMTP (25)**: `VRFY`/`RCPT` user enumeration. - **DBs**: try default creds; Redis (6379) often unauth (→ `web-ssrf-gopher-redis-rce` if internal).3. **Map version → CVE**: `searchsploit <product version>`; verify before firing.## Gotchas- Null/anonymous first — it's free and frequently works before any exploit.- SNMP community `public`/`private` and defaults are the quiet win people skip.- Confirm a CVE actually matches the exact version; wrong minor version = wasted exploit.## Verify successAccess or credentials from a service (share contents, LDAP users, a DB login), or confirmedexploitation of a versioned CVE — feeding foothold/privesc.## ReferencesService-enum references (HackTricks, 0xdf); netexec wiki; GTFOBins/searchsploit.

Frequently asked questions