| name | netbios-enumeration |
| description | Enumerate NetBIOS services (ports 137, 138, 139) to discover server names, workgroups, and MAC addresses during network pentesting. Use this skill whenever you need to enumerate NetBIOS services, discover Windows/Samba shares, investigate network name resolution, or assess NetBIOS security. Trigger this skill for any task involving NetBIOS ports, Windows network enumeration, or SMB-related reconnaissance. |
NetBIOS Enumeration
Overview
NetBIOS provides three core services for network communication:
| Service | Port | Protocol | Purpose |
|---|
| Name Service | 137 | UDP/TCP | Name registration and resolution |
| Datagram Distribution | 138 | UDP | Connectionless communication |
| Session Service | 139 | TCP | Connection-oriented communication |
Quick Start
nmblookup -A <IP>
nbtscan <IP>/30
nmap -sU -sV -T4 --script nbstat.nse -p137 -Pn -n <IP>
Detailed Enumeration
Name Service (Port 137)
The Name Service handles name registration and resolution. Devices participate in a NetBIOS network through a broadcast process where "Name Query" packets are sent. If no objections are received, the name is considered available.
Commands:
nmblookup -A <IP>
nbtscan <IP>/30
nmap -sU -sV -T4 --script nbstat.nse -p137 -Pn -n <IP>
What you'll discover:
- Computer/Server names
- Workgroup or domain membership
- MAC address of the network interface
- User names (sometimes visible)
- NetBIOS service types
Datagram Distribution Service (Port 138)
NetBIOS datagrams allow for connectionless communication via UDP, supporting direct messaging or broadcasting to all network names.
Check if open:
nmap -sU -p138 <IP>
Session Service (Port 139)
The Session Service facilitates connection-oriented interactions between two devices using TCP. A session begins with a "Session Request" packet and supports larger messages, error detection, and recovery.
Check if open:
nmap -sT -p139 <IP>
What to Look For
When enumerating NetBIOS, pay attention to:
- Computer names - The NetBIOS name of the target system
- Workgroup/Domain - Network membership information
- MAC address - Physical network interface identifier
- Service types - What NetBIOS services are running
- User accounts - Sometimes visible in enumeration output
Common Nmap Findings
PORT STATE SERVICE VERSION
137/udp open netbios-ns Samba nmbd netbios-ns (workgroup: WORKGROUP)
138/udp open|filtered netbios-dgm
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
Next Steps After Enumeration
Once you've enumerated NetBIOS services, consider:
- Check SMB vulnerabilities - Port 445 often accompanies NetBIOS
- Attempt null sessions - Anonymous SMB connections
- Look for password hashes - LanMan/NTLM hashes may be accessible
- Investigate share access - Enumerate and access network shares
- Check for misconfigurations - Anonymous access, weak permissions
Automation Script
For repeated enumeration tasks, use the bundled script:
./scripts/netbios-enumerate.sh <IP>
This runs all three enumeration methods and saves results to a file.
References
