SMB:

Enumeration

SMB shares, users, hosts, NetBIOS, and domain info enumeration guides

5 guides • Created Dec 28, 2025 • Updated Mar 29, 2026

5 guides

NetBIOS Name Enumeration

Enumerate NetBIOS names, workgroup/domain info, and MAC addresses from SMB hosts using nbtscan, nmap, and nmblookup to map network targets.

Jan 4, 2026 • 1 min read

SMB Host Security Enumeration

Enumerate SMB hosts to identify shares, sessions, users, and misconfigurations using tools like enum4linux, smbclient, and Nmap scripts.

Jan 4, 2026 • 1 min read

SMB Null Session Enumeration

Exploit unauthenticated SMB null sessions to enumerate shares, users, groups, and domain info using tools like enum4linux, rpcclient, and smbclient.

Jan 4, 2026 • 4 min read

SMB Share Enumeration

Enumerate SMB shares using tools like smbclient, crackmapexec, and enum4linux to discover exposed network shares, permissions, and accessible files.

Jan 4, 2026 • 6 min read

SMB User and Domain Enumeration

Enumerate valid users and domain information from SMB shares using tools like enum4linux, rpcclient, and crackmapexec to map AD attack surfaces.

Jan 4, 2026 • 3 min read

SMB enumeration extracts shares, users, groups, and domain information from Windows and Samba file servers. Start with smbclient -L for share listing and enum4linux-ng or NetExec for comprehensive enumeration in one pass. Null sessions (anonymous access) still work on misconfigured systems and expose user lists, share permissions, password policies, and group memberships.

RID cycling through tools like enum4linux or lookupsid.py brute-forces user and group SIDs even when null session enumeration of SAM is restricted. This reliably extracts local and domain accounts on systems that block anonymous user listing but allow LSA RID lookups.

Session enumeration with NetExec, smbmap, or rpcclient reveals who is logged in, what shares are accessible with your current credentials, and read/write permissions per share. Map every share including hidden ones (ending in $), check for accessible SYSVOL and NETLOGON on domain controllers, and note IPC$ access since it gates many RPC-based enumeration techniques.