Skip to content
HackIndex logo

HackIndex

NetBIOS Session Enumeration

3 min read May 15, 2026

NetBIOS Session Service runs on TCP port 139 and provides SMB over NetBIOS transport — the older sibling of direct SMB over TCP 445. Port 139 is reachable via TCP unlike the UDP-dependent name service on 137, making it useful when UDP is filtered. Session enumeration on 139 reveals whether SMB is available through the NetBIOS layer, which users are currently connected, and what shares are accessible — feeding directly into SMB Null Session Enumeration.

Port Detection

Confirm both NetBIOS ports and SMB are present together:

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 137,138,139,445 $TARGET_IP 
137/udp open  netbios-ns   Microsoft Windows netbios-ns
138/udp open  netbios-dgm  Microsoft Windows netbios-dgm
139/tcp open  netbios-ssn  Microsoft Windows netbios-ssn
445/tcp open  microsoft-ds Microsoft Windows 7 - 10 microsoft-ds

When port 139 is open but 445 is closed, SMB is only available via the NetBIOS transport. Most tools handle both transparently. When 445 is open alongside 139, use 445 directly — it does not depend on NetBIOS name resolution.

Session and User Enumeration via nbtscan

nbtscan on TCP 139 shows active sessions and logged-in users when available:

┌──(kali㉿kali)-[~]
└─$ nbtscan -v $TARGET_IP 
Doing NBT name scan for addresses from 10.10.10.50
Sending queries to 10.10.10.50
10.10.10.50     WS01                     WORKSTATION      JSMITH           00:11:22:33:44:55

JSMITH in the User field means that account is actively logged into the machine. This is immediately useful for password spraying priority — a logged-in user is more likely to have recent activity and reused credentials. Cross-reference found usernames with SAMR/LSA Enumeration with rpcclient for full user and group details.

SMB Connection Test via Port 139

Confirm SMB is reachable through the NetBIOS session layer and test for null session access:

┌──(kali㉿kali)-[~]
└─$ smbclient -L //$TARGET_IP -p 139 -N 2>/dev/null 
	Sharename       Type      Comment
	---------       ----      -------
	IPC$            IPC       Remote IPC
	C$              Disk      Default share
	SHARED          Disk      Company share
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP --port 139 -u '' -p '' --shares 2>/dev/null

nmap SMB Scripts via Port 139

Run SMB NSE scripts explicitly against port 139 when 445 is filtered:

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 139 --script smb-os-discovery,smb-security-mode,smb2-security-mode $TARGET_IP 
| smb-os-discovery:
|   OS: Windows 10 Pro (Windows 10 Pro 6.3)
|   Computer name: WS01
|   NetBIOS computer name: WS01
|   Domain name: company.local
|   FQDN: ws01.company.local
|_  System time: 2026-03-28T12:00:00+00:00

The FQDN and domain name from smb-os-discovery via port 139 are equivalent to what you would get from port 445. Use these to set the domain for Kerberos attacks and LDAP enumeration. Move to SMB Null Session Enumeration for full share, user, and policy enumeration.

References