# NetBIOS

> Windows legacy naming

- **URL:** https://hackindex.io/services/netbios
- **Type:** Service
- **Default ports:** 137, 138, 139
- **Tags:** netbios, windows, legacy, smb, network, naming
- **Published:** 2026-01-26
- **Updated:** 2026-07-13

NetBIOS (Network Basic Input/Output System) provides name resolution and session services over **UDP port 137** (name service), **UDP port 138** (datagram), and **TCP port 139** (session/SMB over NetBIOS). Nmap identifies these as `netbios-ns` and `netbios-ssn`. NetBIOS is common on older Windows networks and is often found alongside SMB on port 445.

NetBIOS name queries reveal hostnames, domain or workgroup membership, and the MAC address of the target. The name table can expose logged-in users and running services. NetBIOS session service on TCP 139 carries legacy SMB traffic, which may allow null session enumeration or share access.

Use `nbtscan` or `nmblookup` to query NetBIOS names across a subnet. Nmap's `nbstat` script extracts the full name table. If TCP 139 is open, test with `smbclient` or `enum4linux-ng` for share and user enumeration using null sessions.

## Phases

- [Enumeration](https://hackindex.io/services/netbios/enumeration.md): Pull hostnames, domain names, and role hints via NetBIOS name tables (2 guides)
- [Vulnerability Discovery](https://hackindex.io/services/netbios/vulnerability-discovery.md): Guides on finding info leaks via NetBIOS enumeration (1 guides)