NetBIOS & SMB Enumeration :

Before we dive into NetBIOS and SMB enumeration, it is important to understand what NetBIOS and SMB actually are. Both are related to Windows networking, but they serve different purposes. Enumeration is one of the most important phases for penetration testing. Enumeration is a part of reconnaissance, Reconnaissance focuses on understanding the target broadly, While enumeration focuses on extracting detailed information from specific services. Enumeration can be considered part of the broader information-gathering process and is often associated with active reconnaissance.

Reconnaissance
│
├── Passive Recon
│   └── Collecting publicly available information
│
└── Active Recon / Enumeration
    └── Collecting detailed information from specific services

Reconnaissance
│
├── Passive Recon
│   └── Collecting publicly available information
│
└── Active Recon / Enumeration
    └── Collecting detailed information from specific services

1. What is NetBIOS ?

NetBIOS (Network Basic Input/Output System) is a network protocol and API (Application Programming Interface) that was developed by IBM in the early 1980s. It provides a set of services for communication between computers on a local area network (LAN). NetBIOS allows applications to communicate over a network and provides a naming system to identify devices and services, as well as the ability to send and receive messages.

• The commonly associated ports of NetBIOS are :

Port            Protocol                    Purpose
------------------------------------------------------
137               UDP                        NetBIOS Name Service (NBNS)

138               UDP                        NetBIOS Datagram Service

139               TCP                        NetBIOS Session Service

Port            Protocol                    Purpose
------------------------------------------------------
137               UDP                        NetBIOS Name Service (NBNS)

138               UDP                        NetBIOS Datagram Service

139               TCP                        NetBIOS Session Service

2. What is SMB ?

SMB stands for Server Message Block. It is a type of network file-sharing protocol. It's primary purpose is to share files, printers, and other resources between computers within a network. SMB is widely used in Windows environments, but it is also supported on Linux, macOS, and other operating systems. It works on top of the TCP/IP protocol. Samba is an open-source implementation of SMB and related Windows networking protocols for Linux and other Unix-like systems. It is very important to know that SMB is the protocol on windows and Samba is the open source implementation of SMB for Linux System.

Port                 Protocol                Purpose
---------------------------------------------------------
139                  TCP                     SMB over NetBIOS Session Service

445                  TCP                     Direct-hosted SMB over TCP

Port                 Protocol                Purpose
---------------------------------------------------------
139                  TCP                     SMB over NetBIOS Session Service

445                  TCP                     Direct-hosted SMB over TCP

3. Relationship between NetBIOS and SMB

NetBIOS ≠ SMB

The both are different technologies, but NetBIOS and SMB are separate technologies that were historically used together in Windows networking. SMB can operate over NetBIOS, but modern SMB commonly operates directly over TCP port 445 without NetBIOS. In modern windows networks, SMB generally operates directly over TCP port 445, so NetBIOS is not necessarily required for SMB communication.

Modern SMB
    │
    ▼
  TCP/445
    │
    ▼
   SMB
    │
    ▼
File & Resource Sharing

Modern SMB
    │
    ▼
  TCP/445
    │
    ▼
   SMB
    │
    ▼
File & Resource Sharing