# Enumeration

> Pull hostnames, domain names, and role hints via NetBIOS name tables

- **URL:** https://hackindex.io/services/netbios/enumeration
- **Service:** [NetBIOS](https://hackindex.io/services/netbios.md)
- **Published:** 2026-01-26
- **Updated:** 2026-03-29

NetBIOS enumeration is about extracting **identity and pivot data** quickly: hostnames, domain or workgroup context, and whether the target is exposing an SMB-adjacent session surface.

**What you want out of NetBIOS**

- Hostname and role hints that improve targeting and wordlists
- Domain or workgroup names that shape authentication and relay decisions
- Confirmation that 139 is usable as an SMB path when 445 is blocked or filtered

**What changes your next move**

- If you get a clear hostname and domain context, move straight into SMB and AD-facing enumeration with the right naming assumptions.
- If only NBNS responds and sessions do not, treat it as “identity only” and pivot to whatever other exposed services exist.
- If 139 is open, align your SMB plan to include SMB-over-139 behavior and tooling support.

**Coverage you typically want under this section**

- Name discovery from NBNS responses
- Session-level checks on 139 and correlation with SMB on 445
- Spoofing considerations only when it is in-scope and relevant to the lab ruleset

## Guides

- [NetBIOS name table enumeration](https://hackindex.io/services/netbios/enumeration/netbios-name-table-enumeration.md)
- [NetBIOS Session Enumeration](https://hackindex.io/services/netbios/enumeration/netbios-session-enumeration.md): Enumerate active NetBIOS sessions over TCP/445 to identify logged-in users, remote hosts, and active connections using tools like nbtstat and enum4linux.