> ## Documentation Index > Fetch the complete documentation index at: https://0-x.dev/llms.txt > Use this file to discover all available pages before exploring further. # 137-139 - NetBIOS (Network Basic Input/Output System) `Default Ports: 137 (Name Service), 138 (Datagram Service), 139 (Session Service)` NetBIOS predates modern TCP/IP networking and was originally how Windows machines found each other and shared resources on a local network before DNS and SMB over TCP took over that job directly. It's largely legacy today, but it's rarely fully disabled, which makes it a quiet but reliable source of hostnames, domain info, and occasionally credentials through its name resolution weaknesses. > **Name Service (137)** > > Resolves NetBIOS names to IP addresses on the local network, the NetBIOS equivalent of DNS. This is what most enumeration tools actually query. > **Session Service (139)** > > Carries the actual SMB session once a name has been resolved. Functionally the predecessor to SMB running directly over port 445. > [!NOTE] > > NetBIOS and SMB are closely tied together historically, port 139 exists specifically to carry SMB traffic over NetBIOS sessions. Deeper SMB share and authentication attacks belong on the [SMB page](https://0-x.dev/untitled-page-4); this page focuses on NetBIOS name resolution and enumeration specifically. *** ## Why NetBIOS Still Matters Modern Windows networks run SMB directly over TCP port 445 and don't strictly need NetBIOS at all, but the services are still enabled by default on most Windows installs for backward compatibility. That leftover functionality is what makes it worth checking: * It often responds even when other enumeration paths are locked down or rate-limited, since it predates most modern logging and alerting. * Name queries can reveal a hostname, workgroup, or domain name without needing any credentials at all. * The underlying name resolution protocol (NBT-NS) is broadcast-based and trivially spoofable, which is the basis for a well-known credential-capturing attack covered further down. *** ## NetBIOS Name Suffixes Every NetBIOS name is actually a 16-character field, padded if necessary, where the last byte (the suffix) indicates what kind of resource the name represents. Reading these suffixes is how you tell a workstation from a domain controller from a browser service in raw NBT-NS output.
Suffix Service Description
`00` Workstation Service Registered by every machine, basic presence on the network
`03` Messenger Service Used for the (long since removed) `net send` service
`20` File Server Service Indicates the host is sharing files, i.e. running SMB
`1B` Domain Master Browser Identifies the domain controller holding the master browse list
`1C` Domain Controllers Group name registered by domain controllers
`1E` Browser Election Service Used in master browser elections
> [!TIP] > > Seeing suffix `1C` in a scan's output is a fast way to spot domain controllers on a subnet without needing to query LDAP or check anything else first. *** ## Enumeration A handful of lightweight, purpose-built tools cover NetBIOS enumeration, all of which work without any credentials since name resolution itself requires none. ```bash theme={null} nbtscan TARGET # single host nbtscan TARGET_RANGE/24 # sweep an entire subnet, fast first step on a new network ``` `nbtscan` output includes the resolved NetBIOS name, the workgroup or domain, and often the MAC address, useful for quickly mapping a subnet before doing anything else. ```bash theme={null} nmblookup TARGET # basic name lookup nmblookup -A TARGET # full node status query, lists every registered name and suffix on the host ``` The `-A` flag is the one worth remembering: it returns the complete suffix table described above for a single host, rather than just the primary name. ```bash theme={null} nmap -sU -p137 --script nbstat TARGET ``` Nmap's `nbstat` script does the same node status query but integrates into a broader scan, convenient when NetBIOS enumeration is just one part of a larger sweep. ```bash theme={null} enum4linux -a TARGET ``` `enum4linux` pulls NetBIOS information alongside its broader SMB enumeration, worth running here too since the two protocols are so closely linked, it's often the single most complete command for a quick first look at a Windows host. *** ## NBT-NS Poisoning > [!WARNING] > > This is an active, intrusive attack that intercepts live authentication traffic on the network, not passive enumeration. Confirm scope explicitly covers this before running it. NBT-NS, the protocol behind NetBIOS name resolution, falls back to a broadcast request whenever DNS resolution fails, essentially asking the entire local network "does anyone know this name?" There's no authentication on these responses, so a tool sitting on the network can simply answer first and claim to be whatever host was being looked for. When a user's machine tries this (often triggered by something as simple as a mistyped share path), it ends up authenticating straight to the attacker instead, handing over an NTLM hash in the process. ```bash theme={null} sudo responder -I INTERFACE ``` This is the same attack and the same tool covered on the SMB page, since NBT-NS poisoning and SMB credential capture are really one continuous attack chain, NetBIOS is just the resolution weakness that makes it possible in the first place. *** ## Quick Reference Tools > **[Hackviser: NetBIOS](https://hackviser.com/tactics/pentesting/services/netbios)** > > Quick-reference pentesting guide for the NetBIOS service. > **[HackTricks: NetBIOS](https://hacktricks.wiki/en/network-services-pentesting/137-138-139-pentesting-netbios.html)** > > Deeper breakdown of NetBIOS enumeration and related attacks. > [!WARNING] > > NetBIOS enumeration itself is passive and low-risk, but NBT-NS poisoning intercepts live traffic. Treat it with the same caution as any other active credential-capture technique. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.