Kali Local & Network Enumeration Scripts

Local and network enumeration — read /etc/passwd for interactive users, parse crontabs for risky scheduled tasks, find SUID binaries, list listening ports with their PIDs, audit sudo privileges and detect ARP cache poisoning.

Kali · Enumeration — script list

Script	Category	What it does
`passwd_file_analyzer.py`	Local Enumeration	Reads `/etc/passwd` and lists interactive-shell users.
`cron_job_parser.py`	Local Enumeration	Parses crontab files to surface risky scheduled tasks.
`log_file_monitor.py`	Local Enumeration	Tails a mock `auth.log` and alerts on failed SSH logins.
`file_hash_checker.py`	Local Enumeration	Hashes critical binaries to check for tampering.
`network_interface_auditor.py`	Network Enumeration	Lists active interfaces and checks for promiscuous mode.
`subnet_mask_parser.py`	Network Enumeration	Parses CIDR notation into network range and host limits.
`live_host_ping_sweep.py`	Network Enumeration	Threaded ICMP sweep to discover active nodes.
`mac_address_spoof_automator.py`	Network Enumeration	Rotates hardware MAC addresses for anonymity.
`dns_recon_resolver.py`	Network Enumeration	Resolves A, MX, and TXT records for target mapping.
`socket_banner_grabber_cli.py`	Network Enumeration	Fingerprints service versions via low-level sockets.
`suid_binary_finder.sh`	Local Enumeration	Finds all SUID files on the system and saves the list.
`open_ports_enumerator.sh`	Local Enumeration	Lists listening ports with their associated PIDs.
`sudo_privilege_checker.sh`	Local Enumeration	Runs `sudo -l` and parses NOPASSWD entries.
`system_info_gatherer.sh`	Local Enumeration	Collects kernel, hostname, and OS info into one file.
`clear_logs_simulator.sh`	Local Enumeration	Demonstrates history/wtmp clearing (defensive awareness only).
`new_connection_alert.sh`	Network Enumeration	Alerts on new unauthorised established TCP connections.
`iptables_firewall_reset.sh`	Network Enumeration	Resets firewall rules to a secure default-deny posture.
`arp_cache_poison_detector.sh`	Network Enumeration	Flags duplicate MACs in the ARP table to warn of spoofing.
`wireless_interface_auditor.sh`	Network Enumeration	Evaluates wireless card modes and monitor capability.
`network_recon_bundle.sh`	Network Enumeration	Aggregates interface, routing, and DNS data into a forensic dump.

Code samples

find_suid_binaries.sh — locate SUID/SGID files

#!/bin/bash
# find_suid_binaries.sh
# Day 5: Security Auditing & System Defense
# Description: Locates files with SUID or SGID bits set (potential privesc vectors).

echo "[*] Searching for SUID/SGID binaries on the system..."
echo "[*] This may take a moment depending on disk size..."
echo "--------------------------------------------------------"

# -perm /4000 looks for SUID
# -perm /2000 looks for SGID
# 2>/dev/null hides permission denied errors

# In test mode (AUDIT/CI set), limit the scan to a small subtree so it returns fast.
SCAN_ROOT="/"
if [ -n "${AUDIT:-}" ] || [ "${CI:-}" = "true" ]; then
    SCAN_ROOT="/usr/bin"
fi

echo "[+] SUID Files (Set Owner User ID):"
find "$SCAN_ROOT" -perm /4000 -type f 2>/dev/null | xargs ls -lh

echo ""
echo "[+] SGID Files (Set Group ID):"
find "$SCAN_ROOT" -perm /2000 -type f 2>/dev/null | xargs ls -lh

echo "--------------------------------------------------------"
echo "[*] Audit complete. Review the above files for unusual or unauthorized binaries."

passwd_file_analyzer.py — interactive users in /etc/passwd

#!/usr/bin/env python3
"""
passwd_file_analyzer.py
Day 11: Local Enumeration
Description: Reads /etc/passwd and extracts users with interactive shell access.
"""

import os

def analyze_passwd():
    passwd_path = "/etc/passwd"
    
    # Check if the file exists (to avoid errors in non-Linux environments)
    if not os.path.exists(passwd_path):
        print(f"[-] Error: {passwd_path} not found. Are you on a Linux system?")
        return

    interactive_shells = ["/bin/bash", "/bin/sh", "/bin/zsh", "/usr/bin/bash", "/usr/bin/zsh"]
    
    print(f"[*] Analyzing {passwd_path} for interactive users...")
    print("-" * 50)
    print(f"{'Username':<15} {'UID':<6} {'Shell':<15}")
    print("-" * 50)

    try:
        with open(passwd_path, "r") as f:
            for line in f:
                parts = line.strip().split(":")
                if len(parts) >= 7:
                    username = parts[0]
                    uid = parts[2]
                    shell = parts[6]
                    
                    if shell in interactive_shells:
                        print(f"{username:<15} {uid:<6} {shell:<15}")
                        
    except Exception as e:
        print(f"[-] An error occurred: {e}")

if __name__ == "__main__":
    analyze_passwd()

View the full toolkit on GitHub

Kali Local & Network Enumeration Scripts

Kali · Enumeration — script list

Code samples

find_suid_binaries.sh — locate SUID/SGID files

passwd_file_analyzer.py — interactive users in /etc/passwd

Related pages

Explore Termux Hub

Kali Toolkit

Termux tool guides

Learn