Enumeration avoidance techniques
As seen in the content of this chapter, an attacker can gain a lot of critical infrastructure information by using freely available tools and techniques. As penetration testers we cannot simply focus on the attacking of the network, we must also understand the mitigating controls sufficiently to be able to offer advice and guidance to our customers. There are several methods that can be used by a corporation that will make it more difficult for an attacker to gain the information necessary to make a stealthy, successful attack on the customer's assets.
Naming conventions
Administrators should be encouraged to use naming schemes that do not give away information about the devices. For instance, if you were to use your Nmap-Fu or DNS-Fu to pull the hostnames and find that the machines are labeled as follows:
dns1.example.commail.example.comdomainserverdevserveradministratorspivotpointrogueWAP
This would instantly give you an idea of which systems you...
