netbios-enumeration

name

netbios-enumeration

description

Enumerate NetBIOS services (ports 137, 138, 139) to discover server names, workgroups, and MAC addresses during network pentesting. Use this skill whenever you need to enumerate NetBIOS services, discover Windows/Samba shares, investigate network name resolution, or assess NetBIOS security. Trigger this skill for any task involving NetBIOS ports, Windows network enumeration, or SMB-related reconnaissance.

NetBIOS Enumeration

Overview

NetBIOS provides three core services for network communication:

Service	Port	Protocol	Purpose
Name Service	137	UDP/TCP	Name registration and resolution
Datagram Distribution	138	UDP	Connectionless communication
Session Service	139	TCP	Connection-oriented communication

Quick Start

# Enumerate NetBIOS names and MAC addresses
nmblookup -A <IP>

# Scan a subnet for NetBIOS hosts
nbtscan <IP>/30

# Nmap enumeration with nbstat script
nmap -sU -sV -T4 --script nbstat.nse -p137 -Pn -n <IP>

Detailed Enumeration

Name Service (Port 137)

The Name Service handles name registration and resolution. Devices participate in a NetBIOS network through a broadcast process where "Name Query" packets are sent. If no objections are received, the name is considered available.

Commands:

# Query a specific host for NetBIOS names
nmblookup -A <IP>

# Scan a subnet range
nbtscan <IP>/30


nmap -sU -sV -T4 --script nbstat.nse -p137 -Pn -n <IP>