SERVICE ENUMERATION / ENUMERATION
SMB enumeration
Build a reliable picture of Windows file-sharing services before attempting authentication or lateral movement.
LEARNING OBJECTIVES
What you should be able to do
- ✓Identify SMB versions and signing posture
- ✓List accessible shares without assuming anonymous access
- ✓Record hostnames, domains, users, and useful files as evidence
CORE CONCEPT
Understand before you run
SMB commonly exposes TCP 445; NetBIOS-related ports may provide additional context.
A share listing is a lead, not proof of sensitive access: validate read and write permissions separately.
SMB signing status matters when assessing relay exposure, but a disabled setting alone is not a complete exploit path.
COMMAND REFERENCE
Quick reference
nmap -p445 --script smb-protocols,smb2-security-mode <target>Inspect SMB dialects and signing
smbclient -L //<target> -NAttempt anonymous share listing in a lab
nxc smb <target> -u '<user>' -p '<password>' --sharesValidate known credentials and enumerate shares
COMMON MISTAKES
Check yourself
- Treating a hostname discovered in SMB output as proof of a domain relationship.
- Reading files before documenting the share, path, and access level.
- Using production credentials or broad password spraying outside an explicitly authorized lab.