Lion Cipher Lab
Enumerate the SMB shares on your OWN lab host
- Penetration Testing / Red Team
- Intermediate
- ~45 min
- Free · no account required
Why it matters
SMB is the protocol Windows uses to share files, folders, and printers across a network, and it is everywhere — office file servers, home NAS boxes, Windows PCs with sharing turned on. That ubiquity makes exposed SMB shares one of the most common ways real data leaks out (an anonymous connection quietly reading a folder full of documents) and one of the classic footholds for lateral movement, where an attacker who lands on one machine uses reachable shares to spread to others. Enumerating the shares on a host you own is the direct defensive answer to "what am I exposing?": it shows you,…
What you'll learn
- SMB share enumeration
- finding SMB with Nmap on port 445
- listing shares with smbclient -L
- testing for null and guest sessions
- reading share access permissions
- deep enumeration with enum4linux-ng
- identifying SMBv1 / MS17-010 exposure
- defensive hardening of file shares
- authorized-use discipline
Steps in this lab
- The one rule, before you touch a single share
- What SMB is, and why an exposed share is dangerous
- Install the tools
- Find SMB and identify the host with nmap
- List the shares — and test for a null session — with nmap
- Confirm it by hand with smbclient -L
- Go deeper with enum4linux-ng
- The defensive takeaway — close what you just found
- What you just did — and why it is the check every defender should run