Once the services have been fingerprinted, we can enumeration. There can be many different sources used to achieve the goal of this recipe. In this recipe, we will look at how to service-discovery scans using various tools, for the following:
- SMB scan
- SNMP scan
- Using the NSE (nmap scripting engine) engine
Nbtscan is a in Kali that enumerates for the NetBIOS name of the target IP. It can be used as the early part of SMB enumeration. It basically requests a status query of the NetBIOS name in a human-readable format.
For this recipe, the steps are as follows:
- To enumerate the NetBIOS name, we will run the following command in terminal:
nbtscan <IP address>
The output will be as shown in the following screenshot:
- You can run the NetBIOS enumeration over a class range as well, using the following command in terminal:
nbtscan -r <IP address>/<class range...