Skip to content
HackIndex logo

HackIndex

NetBIOS:

Enumeration

Pull hostnames, domain names, and role hints via NetBIOS name tables

2 guides • Updated Mar 29, 2026
2 guides

NetBIOS Session Enumeration

Enumerate active NetBIOS sessions over TCP/445 to identify logged-in users, remote hosts, and active connections using tools like nbtstat and enum4linux.

Mar 30, 2026 • 3 min read

NetBIOS enumeration is about extracting identity and pivot data quickly: hostnames, domain or workgroup context, and whether the target is exposing an SMB-adjacent session surface.

What you want out of NetBIOS

  • Hostname and role hints that improve targeting and wordlists

  • Domain or workgroup names that shape authentication and relay decisions

  • Confirmation that 139 is usable as an SMB path when 445 is blocked or filtered

What changes your next move

  • If you get a clear hostname and domain context, move straight into SMB and AD-facing enumeration with the right naming assumptions.

  • If only NBNS responds and sessions do not, treat it as “identity only” and pivot to whatever other exposed services exist.

  • If 139 is open, align your SMB plan to include SMB-over-139 behavior and tooling support.

Coverage you typically want under this section

  • Name discovery from NBNS responses

  • Session-level checks on 139 and correlation with SMB on 445

  • Spoofing considerations only when it is in-scope and relevant to the lab ruleset