Enumerating user accounts of Windows targets
User enumeration allows attackers to conduct dictionary attacks against systems and reveals information about who has access to them. Against Windows systems, there are two known techniques to enumerate the users in the system: SAMR enumeration and LSA brute forcing. Both user enumeration techniques are implemented in NSE. While this attack requires a valid account on most systems, some systems (such as Windows 2000 by default) allow user enumeration anonymously.
This recipe shows how to enumerate users that have logged in to a Microsoft Windows system with Nmap.
How to do it...
Open your terminal and enter the following Nmap command:
$ nmap -p139,445 --script smb-enum-users <target>
If the system allows user enumeration anonymously, the user list will be included in the scan results. Remember that in modern systems, you need to provide valid credentials as anonymous access is disabled by default:
Host script results...