which phase of discovery are credentials required?

[Jarvis Patil]

Discovery has four phases as follows.
1. Scanning
2.Classification
3.dentification
4.Exploration
So, at which phase of discovery are credentials required?

[User663678]

The credentials are utilised at the Classification stage-This is the first time Discovery uses credentials to query a target. 

[Robin J_]

Hi Jarvis,
I see that RaghavSh already came with a great follow up questions, but I would rather like to know what is the query behind this? Do you have some credentials which's does not work or are you just learning Discovery?

I would also like to add that "Test Credential" could fail even if the credentials work. Always make sure the port is open/reachable from the mid-server. For example we had a "hardened" Windows server where port 135 locally was not opened. This resulted in Test Credential = Fail, but the real issue was that there was no connectivity. 

Kind regards,
Robin

[doug_schulze]

Credentials are used in the classification and identification/exploration phases contained in the pattern execution. The only time they are used in the first phase (shazzam) is the use of SNMP credentials so we can get a response from the sysdescr query from network devices .

[thebananek]

@doug_schulze could you elaborate more on topic of using credentials on each phase? For example, from my understanding: port probe win goes to windows classification when 135 tcp port is opened. Next Windows classification determines which exactly windows OS version discovery is dealing with. Is it 2008, 2012, 2016, etc.? I am not sure but I suppose that to get this information from scanned CI, credentials have to be used and successful. And we are still in 2nd phase - classification.
Once OS version is known, lets say it's 2016, windows classifier triggers probe Horizontal Pattern which launches Windows OS - Servers pattern.
And here we enter into 3rd phase - identification. Of course credentials are used to get information from WMI.

I don't know if session from 2nd phase is remained till 3rd (and 4th) phase is completed or on each phase 2nd, 3rd, 4th new session is initiated. Maybe you can answer?

[doug_schulze]

They would be new sessions.