pentesting-netbios

name	pentesting-netbios
description	Testing NetBIOS over TCP/IP services during authorized engagements. Covers the NetBIOS Name Service (137/udp, 137/tcp), Datagram Service (138/udp), and Session Service (139/tcp). Focuses on name and MAC enumeration with nmblookup, nbtscan and nmap nbstat, identifying workgroups/domains, and pivoting to SMB over NetBIOS (139) for share and user enumeration.
domain	cybersecurity
subdomain	network-services-pentesting
tags	["penetration-testing","network-services","netbios","smb","windows","enumeration"]
version	1.0
author	xalgorix
license	Apache-2.0

Pentesting NetBIOS (ports 137/138/139)

When to Use

• During authorized internal network assessments when UDP 137, UDP 138, or TCP 139 is reachable
• When mapping Windows hosts on a LAN by NetBIOS name, workgroup/domain, and MAC address
• When TCP 445 is filtered but 139 is open (SMB over NetBIOS still works)
• As an early reconnaissance step before SMB/Active Directory enumeration
• When investigating NBT-NS/LLMNR poisoning opportunities for credential capture

Quick Enumeration

# Names the server uses + MAC address (Name Service, 137)
nmblookup -A <IP>
nbtscan <IP>/30
nbtscan -r 192.168.0.1/24                              # scan a /24 quickly
sudo nmap -sU -sV -T4 --script nbstat.nse -p137 -Pn -n <IP>

# Session service banner (139) — confirms SMB-over-NetBIOS
nmap -p139 -sV <IP>
# Expected: 139/tcp open netbios-ssn Microsoft Windows netbios-ssn

# Name service banner (137/udp)
# Expected: 137/udp open netbios-ns Samba nmbd netbios-ns (workgroup: WORKGROUP)

Critical: Checks Most Often Missed

1. Workgroup vs domain disclosure — the NetBIOS name table reveals the workgroup or NT domain (<1C>/<00> group entries), giving you the AD/workgroup name for free before touching SMB.
2. MAC address leak — nbtscan/nbstat return the server MAC, useful for vendor fingerprinting and pivoting.
3. Unique vs group name suffixes — suffix bytes identify roles: <00> workstation, <20> File Server (SMB enabled), <1B> Domain Master Browser (often the PDC), <1C> Domain Controllers group. A <20> means the host serves SMB — pivot to share enumeration.
4. SMB still reachable on 139 — if 445 is filtered, 139 (NBT over IP) frequently still exposes the full SMB attack surface. Point your SMB tooling at port 139.
5. NBT-NS poisoning surface — broadcast name resolution on 137/udp can be poisoned with Responder to capture NetNTLM hashes on the segment.

How to CONFIRM: NetBIOS is confirmed when nmblookup -A <IP> returns a name table (lines with <XX> suffixes) or nbtscan lists the name and MAC. A suffix confirms the host runs an SMB file server reachable over 139.