SMB:
Enumeration
SMB shares, users, hosts, NetBIOS, and domain info enumeration guides
NetBIOS Name Enumeration
Enumerate NetBIOS names, workgroup/domain info, and MAC addresses from SMB hosts using nbtscan, nmap, and nmblookup to map network targets.
SMB Host Security Enumeration
Enumerate SMB hosts to identify shares, sessions, users, and misconfigurations using tools like enum4linux, smbclient, and Nmap scripts.
SMB Null Session Enumeration
Exploit unauthenticated SMB null sessions to enumerate shares, users, groups, and domain info using tools like enum4linux, rpcclient, and smbclient.
SMB User and Domain Enumeration
Enumerate valid users and domain information from SMB shares using tools like enum4linux, rpcclient, and crackmapexec to map AD attack surfaces.
SMB enumeration extracts shares, users, groups, and domain information from Windows and Samba file servers. Start with smbclient -L for share listing and enum4linux-ng or NetExec for comprehensive enumeration in one pass. Null sessions (anonymous access) still work on misconfigured systems and expose user lists, share permissions, password policies, and group memberships.
RID cycling through tools like enum4linux or lookupsid.py brute-forces user and group SIDs even when null session enumeration of SAM is restricted. This reliably extracts local and domain accounts on systems that block anonymous user listing but allow LSA RID lookups.
Session enumeration with NetExec, smbmap, or rpcclient reveals who is logged in, what shares are accessible with your current credentials, and read/write permissions per share. Map every share including hidden ones (ending in $), check for accessible SYSVOL and NETLOGON on domain controllers, and note IPC$ access since it gates many RPC-based enumeration techniques.