# SMB Signing Not Required Detection

> Identifies SMB servers with message signing disabled, enabling relay and MITM attacks. Covers detection via Nmap, Nessus, and manual verification methods.

- **URL:** https://hackindex.io/services/smb/vulnerability-discovery/smb-signing-not-required-detection
- **Path:** SMB > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/smb/vulnerability-discovery.md)
- **Published:** 2026-03-06
- **Updated:** 2026-05-15

If SMB signing is not required, the host is a relay candidate. That matters because relayed authentication can turn a passive capture or coerced auth event into remote actions on the target, depending on what the relayed identity can do.

Start with the signing checks.

## SMB Signing Detection

```bash
nmap -Pn -p 445 --script smb-security-mode,smb2-security-mode $TARGET_IP
nxc smb $TARGET_IP
# | smb2-security-mode:
# |   3.1.1:
# |     Message signing enabled but not required
```

If signing is enabled but not required, keep the host in scope for relay paths. If signing is required, SMB relay against that target is usually not worth more time.

Check the protocol mix at the same time.

```bash
nmap -Pn -p 445 --script smb-security-mode,smb2-security-mode,smb-protocols $TARGET_IP
```

If the host also supports SMBv1, the SMB posture is weaker overall and legacy checks become more relevant.

If you already have credentials, confirm the host is still interesting in a real session.

```bash
nxc smb $TARGET_IP -u "$USER" -p "$PASSWORD"
smbclient -L //$TARGET_IP -U "$USER%$PASSWORD"
```

Authenticated access does not change the signing result, but it does change priority. A reachable host that accepts valid sessions and does not require signing is a much stronger relay target than an isolated unauthenticated service.

SMB signing states and their impact:

- **Signing required**: relay attacks blocked against this target
- **Signing enabled but not required**: relay is possible, client downgrades
- **Signing disabled**: fully vulnerable to relay and MitM
- **SMBv1 only**: no signing support at all on older configs

What changes your next move is simple. If signing is required, move on to shares and access control. If signing is not required, document it as relay exposure and check whether that condition exists broadly across servers, workstations, or both.

For executing the relay against identified targets, see [SMB NTLM Relay](https://hackindex.io/services/smb/exploitation/ntlm-relay) and [AD NTLM Relay](https://hackindex.io/platforms/active-directory/exploitation/ad-ntlm-relay).

## References

- [smb-security-mode NSE Script](https://nmap.org/nsedoc/scripts/smb-security-mode.html) - SMBv1 security mode and signing state
- [smb2-security-mode NSE Script](https://nmap.org/nsedoc/scripts/smb2-security-mode.html) - SMBv2 and SMBv3 signing state
- [smb-protocols NSE Script](https://nmap.org/nsedoc/scripts/smb-protocols.html) - Supported SMB dialect detection
- [Overview of SMB signing in Windows](https://learn.microsoft.com/en-us/windows-server/storage/file-server/smb-signing-overview) - Signing behavior and security context