# SMB Enumeration Tools

### Intro

SMB has two ports, 445 and 139. 

<figure><img src="https://1920086362-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDfv51K0WXLZdwTryHQZc%2Fuploads%2FlVJVyB7xBfYMbfbqlqSz%2Fimage.png?alt=media&#x26;token=ca2f8e57-c274-4794-9f23-b4ea8b2db77b" alt=""><figcaption></figcaption></figure>

***

### **smbmap**

is one of the best ways to enumerate samba. smbmap allows pen-testers to run commands(given proper permissions), download and upload files, and overall is just incredibly useful for smb enumeration.

***

### **smbclient**

allows you to do most of the things you can do with smbmap, and it also offers you and interactive prompt.

#### List Shares

`smbclient -L ip` It list all the samba shares on the network

***

### **impacket**

is a collection of extremely useful windows scripts. It is worth mentioning here, as it has many scripts available that use samba to enumerate and even gain shell access to windows machines. All scripts can be found (<https://github.com/SecureAuthCorp/impacket>) ; Note: impacket has scripts that use other protocols and services besides samba.

***

### **enum4linux**

Enum4linux is a tool used to enumerate SMB shares on both Windows and Linux systems. It is basically a wrapper around the tools in the Samba package and makes it easy to quickly extract information from the target pertaining to SMB. The syntax of Enum4Linux is nice and simple: `enum4linux [options] ip`

***


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://notes.nomanaziz.me/cybersecurity/penetration-testing/tryhackme/main-methodology/2.-enumeration-scanning/smb-enumeration-tools.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.