3 posts
NetBIOS enumeration is the process of querying the legacy NetBIOS over TCP/IP service on Windows networks to learn computer names, workgroup or domain names, running services and sometimes shared folders. Attackers use it early in an intrusion to map targets, and authorised penetration testers use it to show how much a network gives away. It relies on UDP 137 and 138 and TCP 139, defined in RFC 1001 and RFC 1002.
Enumeration is the stage of a security assessment where the tester actively connects to discovered systems to extract details such as user names, groups, shares, service versions, DNS records and device settings. It follows scanning and comes before vulnerability analysis. Attackers do the same thing to choose targets. Common sources are SMB and NetBIOS, SNMP, LDAP, DNS, SMTP and web applications.
Network scanning is the process of sending probes to a range of addresses to find live hosts, open ports, running services and known weaknesses. It has four common types: host discovery, port scanning, service and version detection, and vulnerability scanning. Attackers scan to find targets, while defenders and authorised testers scan their own networks to find exposures before attackers do.
