# 1. Netbios Enumeration (Port 137)

NetBIOS stands for Network Basic Input Output System. Windows uses NetBIOS for file and printer sharing. A NetBIOS name is a unique computer name assigned to Windows systems, comprising a 16-character ASCII string that identifies the network device over TCP/IP. The first 15 characters are used for the device name, and the 16th is reserved for the service or name record type.

{% embed url="<https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/nbtstat>" %}

{% hint style="info" %}
Port **139** is used by **SMB** dialects that communicate over NetBIOS.

Port **137** is utilized by the **NetBIOS Name service**.&#x20;
{% endhint %}

## 1. Perform Netbios enumeration with windows command line

check the name

```
nbtstat -a 192.168.18.110
```

<figure><img src="/files/zjFxiOXN4zwsauojaxvd" alt=""><figcaption></figcaption></figure>

check the contents of Netbios cache

```
nbtstat -c
```

<figure><img src="/files/W6YHoPF6nOrNSbIMHSEF" alt=""><figcaption></figcaption></figure>

enumerate shares without creating share

```
net use
```

<figure><img src="/files/QXem4nMlW3ZeLTPeGJ9I" alt=""><figcaption></figcaption></figure>

## <mark style="color:red;">2. Netbios enumerator</mark>

Windows application

{% embed url="<https://nbtenum.sourceforge.net/>" %}

<figure><img src="/files/xHST9gSAEqKQ0lRhWVIu" alt=""><figcaption></figcaption></figure>

## <mark style="color:red;">3. Netbios enumeration with NSE scripts</mark>

```
nmap -sV -v --script nbstat.nse 192.168.18.110
```

<figure><img src="/files/zHDBRsNHtqIqpzxIVIRW" alt=""><figcaption></figcaption></figure>

```
nmap -sU -p 137 --script nbstat.nse 192.168.18.110
```

{% embed url="<https://www.udemy.com/course/ethical-hacker-practical/?referralCode=289CF01CF51246BCAD6C>" %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://ceh-practical.cavementech.com/module-4.-enumeration/1.-netbios-enumeration-port-137.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.