Mondom, a samba share esetén NetBIOS alapú névfeloldás van. Ez a nyitja ez nem OS, hanem protokoll függő.
February 2, 2025 at 12:31 PM
Mondom, a samba share esetén NetBIOS alapú névfeloldás van. Ez a nyitja ez nem OS, hanem protokoll függő.
Remote Desktop Protocol NTLM Info:
OS: Windows Server 2022
OS Build: 10.0.20348
Target Name: WIN-S9M9RHARTVH
NetBIOS Domain Name: WIN-S9M9RHARTVH
NetBIOS Computer Name: WIN-S9M9RHARTVH
#Anonymous #OpIsrael
server in #Mexico
OS: Windows Server 2022
OS Build: 10.0.20348
Target Name: WIN-S9M9RHARTVH
NetBIOS Domain Name: WIN-S9M9RHARTVH
NetBIOS Computer Name: WIN-S9M9RHARTVH
#Anonymous #OpIsrael
server in #Mexico
May 6, 2025 at 12:55 AM
Remote Desktop Protocol NTLM Info:
OS: Windows Server 2022
OS Build: 10.0.20348
Target Name: WIN-S9M9RHARTVH
NetBIOS Domain Name: WIN-S9M9RHARTVH
NetBIOS Computer Name: WIN-S9M9RHARTVH
#Anonymous #OpIsrael
server in #Mexico
OS: Windows Server 2022
OS Build: 10.0.20348
Target Name: WIN-S9M9RHARTVH
NetBIOS Domain Name: WIN-S9M9RHARTVH
NetBIOS Computer Name: WIN-S9M9RHARTVH
#Anonymous #OpIsrael
server in #Mexico
#OpIsrael DDoS attack landscape
1. CLDAP Amplification
2. DNS
3. DNS Amplification
4. ICMP
5. IPMI Amplification
6. NTP Amplification
7. NetBIOS Amplification
8. RIPv1 Amplification
9. SNMP Amplification
10. TCP RST
11. TCP SYN
12. UDP
#OpIsrael #Anonymous
1. CLDAP Amplification
2. DNS
3. DNS Amplification
4. ICMP
5. IPMI Amplification
6. NTP Amplification
7. NetBIOS Amplification
8. RIPv1 Amplification
9. SNMP Amplification
10. TCP RST
11. TCP SYN
12. UDP
#OpIsrael #Anonymous
February 4, 2025 at 7:52 AM
#OpIsrael DDoS attack landscape
1. CLDAP Amplification
2. DNS
3. DNS Amplification
4. ICMP
5. IPMI Amplification
6. NTP Amplification
7. NetBIOS Amplification
8. RIPv1 Amplification
9. SNMP Amplification
10. TCP RST
11. TCP SYN
12. UDP
#OpIsrael #Anonymous
1. CLDAP Amplification
2. DNS
3. DNS Amplification
4. ICMP
5. IPMI Amplification
6. NTP Amplification
7. NetBIOS Amplification
8. RIPv1 Amplification
9. SNMP Amplification
10. TCP RST
11. TCP SYN
12. UDP
#OpIsrael #Anonymous
NetBIOS is all that we needed.
October 16, 2023 at 12:50 AM
NetBIOS is all that we needed.
Locating domain controllers is a tricky thing, but I had no idea it could be using NetBIOS under the hood. There's now a policy to control NetBIOS usage in DCLocator, and it's hardened by default to disable NetBIOS usage
April 29, 2025 at 5:44 PM
Locating domain controllers is a tricky thing, but I had no idea it could be using NetBIOS under the hood. There's now a policy to control NetBIOS usage in DCLocator, and it's hardened by default to disable NetBIOS usage
so damn many things are still NetBIOS that Steve hasn't managed to burn out yet
April 29, 2025 at 6:40 PM
so damn many things are still NetBIOS that Steve hasn't managed to burn out yet
Only kind of related, but a few years ago i discovered that Internet Explorer issues NetBIOS name resolution requests over the local network if a URL is invalid or unresolved.
Mistype an address and it gets broadcast over the whole local network. 🙄
Mistype an address and it gets broadcast over the whole local network. 🙄
August 28, 2025 at 2:05 PM
Only kind of related, but a few years ago i discovered that Internet Explorer issues NetBIOS name resolution requests over the local network if a URL is invalid or unresolved.
Mistype an address and it gets broadcast over the whole local network. 🙄
Mistype an address and it gets broadcast over the whole local network. 🙄
just be glad i didn't mention the lack of a netbios name from the terminals
December 17, 2024 at 8:30 PM
just be glad i didn't mention the lack of a netbios name from the terminals
I continue to be annoyed by automated pen testing leading K-12 IT people in the wrong direction. A district asked me about LLMNR & NetBIOS findings and commented they were annoyed to have any findings.
This district has no MFA in Entra.
This district has no MFA in Entra.
January 7, 2025 at 4:30 PM
I continue to be annoyed by automated pen testing leading K-12 IT people in the wrong direction. A district asked me about LLMNR & NetBIOS findings and commented they were annoyed to have any findings.
This district has no MFA in Entra.
This district has no MFA in Entra.
I'd say "mainly used for consumer stuff" is a bit off, win10 and up supports and uses it(afaik they are intending to replace NetBIOS with it), not sure for what: but Chromebooks also generate a good share of mDNS traffic.
You should expect it, and see it in any enterprise environment.
You should expect it, and see it in any enterprise environment.
January 13, 2025 at 9:51 AM
I'd say "mainly used for consumer stuff" is a bit off, win10 and up supports and uses it(afaik they are intending to replace NetBIOS with it), not sure for what: but Chromebooks also generate a good share of mDNS traffic.
You should expect it, and see it in any enterprise environment.
You should expect it, and see it in any enterprise environment.
Aham. Apple. Az lehet, hogy az avahinak kavart be a samba telepités, mert a samba és az avahi is biztosít egyfajta névfeloldási szolgáltatást, a Samba NetBIOS alapon, az avahi pedig mDNS (Bonjur) alapon. És az Apple az utóbbit preferálja. A .local domaint az Avahi hirdeti egyébként. %
February 1, 2025 at 3:54 PM
Aham. Apple. Az lehet, hogy az avahinak kavart be a samba telepités, mert a samba és az avahi is biztosít egyfajta névfeloldási szolgáltatást, a Samba NetBIOS alapon, az avahi pedig mDNS (Bonjur) alapon. És az Apple az utóbbit preferálja. A .local domaint az Avahi hirdeti egyébként. %
Probably your backup uses netbios or something and you should change your backup tool? e.g. NHS ransomware.
January 31, 2025 at 12:16 AM
Probably your backup uses netbios or something and you should change your backup tool? e.g. NHS ransomware.
Disabling NetBIOS over TCP/IP and Link Local Multicast Name Resolution (LLNMR), preferably domain-wide via Group Policy, will give you two quick wins protecting your network.
Remember, securing a network requires a multilayered and "assume breach" approach.
#sysadmin #infosec #itadmin
Remember, securing a network requires a multilayered and "assume breach" approach.
#sysadmin #infosec #itadmin
December 7, 2024 at 4:17 PM
Absolutely no idea what the problem is besides maybe SMB1/Netbios bitrot in server 2008? Im gonna try some older Windows Server versions in a bit, but then the problem becomes getting files onto them since anything before 2008 is smb1 only, which nothing modern really does
August 12, 2025 at 3:11 AM
Absolutely no idea what the problem is besides maybe SMB1/Netbios bitrot in server 2008? Im gonna try some older Windows Server versions in a bit, but then the problem becomes getting files onto them since anything before 2008 is smb1 only, which nothing modern really does
マシン名でSMBアクセスするとexplorerが変な固まり方をするのに悩んでいたのだが、NASで接続先のIPがlocalhostになっているのをみて気づいた、LAN内なのにtailscale経由で接続してるからだ…名前解決がNetBIOSよりDNSが優先されるのでtailscaleのIPで接続しちゃうのか… support.microsoft.com/ja-jp/topic/...
April 12, 2024 at 1:57 PM
マシン名でSMBアクセスするとexplorerが変な固まり方をするのに悩んでいたのだが、NASで接続先のIPがlocalhostになっているのをみて気づいた、LAN内なのにtailscale経由で接続してるからだ…名前解決がNetBIOSよりDNSが優先されるのでtailscaleのIPで接続しちゃうのか… support.microsoft.com/ja-jp/topic/...
Wep, lmnt, and NetBIOS, like a king 👑
April 25, 2025 at 8:59 PM
Wep, lmnt, and NetBIOS, like a king 👑
What does kerberos logging on the client say specifically? Disabling NTLM wouldn't affect DC location at all, but additional changes to remove netbios name resolution are catching folks off guard.
Cred guard likely has nothing to do with it.
Cred guard likely has nothing to do with it.
Enable Kerberos event logging - Windows Server
This article provides a solution on how to enable Kerberos event logging on a particular machine.
learn.microsoft.com
May 22, 2025 at 2:33 AM
What does kerberos logging on the client say specifically? Disabling NTLM wouldn't affect DC location at all, but additional changes to remove netbios name resolution are catching folks off guard.
Cred guard likely has nothing to do with it.
Cred guard likely has nothing to do with it.
TIL about TCPBEIU, or NetBIOS over TCP/IP.
OS/2 TCPBEUI Name Resolution | OS/2 Museum
www.os2museum.com
October 11, 2024 at 3:56 PM
TIL about TCPBEIU, or NetBIOS over TCP/IP.
I'm happy NetBIOS domain controller detection is getting disabled for a different reason: it makes cross-platform domain controller detection easier to implement in a way that matches the built-in Windows DCLocator behavior
April 29, 2025 at 7:55 PM
I'm happy NetBIOS domain controller detection is getting disabled for a different reason: it makes cross-platform domain controller detection easier to implement in a way that matches the built-in Windows DCLocator behavior
The bgp.tools March 2025 Changelog is out! bgp.tools/kb/march-202..., This month changes include:
* Silence alerts for ranges of prefixes
* bgp.tools is now on 100 IX Points!
* New social media (and bots)
and (as always) many other small fixes! Find all of them here: bgp.tools/kb/march-202...
* Silence alerts for ranges of prefixes
* bgp.tools is now on 100 IX Points!
* New social media (and bots)
and (as always) many other small fixes! Find all of them here: bgp.tools/kb/march-202...
March 18, 2025 at 8:01 PM
The bgp.tools March 2025 Changelog is out! bgp.tools/kb/march-202..., This month changes include:
* Silence alerts for ranges of prefixes
* bgp.tools is now on 100 IX Points!
* New social media (and bots)
and (as always) many other small fixes! Find all of them here: bgp.tools/kb/march-202...
* Silence alerts for ranges of prefixes
* bgp.tools is now on 100 IX Points!
* New social media (and bots)
and (as always) many other small fixes! Find all of them here: bgp.tools/kb/march-202...
Particularly when tcp/ip is added to the mix (and tcpbeui). Who needs that in DOS anyway? It's for the big boys in suits running OS/2 and they have all the memory in the world!
I mean a 286 with NetBIOS over TCP/IP is quickly down to ~450kb conventional mem by the time the first drive is mapped..
I mean a 286 with NetBIOS over TCP/IP is quickly down to ~450kb conventional mem by the time the first drive is mapped..
December 10, 2024 at 3:49 AM
Particularly when tcp/ip is added to the mix (and tcpbeui). Who needs that in DOS anyway? It's for the big boys in suits running OS/2 and they have all the memory in the world!
I mean a 286 with NetBIOS over TCP/IP is quickly down to ~450kb conventional mem by the time the first drive is mapped..
I mean a 286 with NetBIOS over TCP/IP is quickly down to ~450kb conventional mem by the time the first drive is mapped..
Twitter でダラダラ書いていたけど、bsky にも転載
事象: Windows の名前解決で、DNS で解決可能にも関わらず、`nslookup win` だと名前解決出来るのに、`ping win` では名前解決されなかった
原因: Windows でドットのないホスト名を名前解決する場合、ブロードキャスト系の名前解決（Windows 11 の場合は mDNS、LLMNR、NetBIOS の順）のみで名前解決が行われ、DNS で名前解決されないようだ
解決: `ping win.` のように FQDN を明示するか、win.local のように mDNS で引っかかるよう設定する
事象: Windows の名前解決で、DNS で解決可能にも関わらず、`nslookup win` だと名前解決出来るのに、`ping win` では名前解決されなかった
原因: Windows でドットのないホスト名を名前解決する場合、ブロードキャスト系の名前解決（Windows 11 の場合は mDNS、LLMNR、NetBIOS の順）のみで名前解決が行われ、DNS で名前解決されないようだ
解決: `ping win.` のように FQDN を明示するか、win.local のように mDNS で引っかかるよう設定する
October 23, 2024 at 5:24 AM
Twitter でダラダラ書いていたけど、bsky にも転載
事象: Windows の名前解決で、DNS で解決可能にも関わらず、`nslookup win` だと名前解決出来るのに、`ping win` では名前解決されなかった
原因: Windows でドットのないホスト名を名前解決する場合、ブロードキャスト系の名前解決（Windows 11 の場合は mDNS、LLMNR、NetBIOS の順）のみで名前解決が行われ、DNS で名前解決されないようだ
解決: `ping win.` のように FQDN を明示するか、win.local のように mDNS で引っかかるよう設定する
事象: Windows の名前解決で、DNS で解決可能にも関わらず、`nslookup win` だと名前解決出来るのに、`ping win` では名前解決されなかった
原因: Windows でドットのないホスト名を名前解決する場合、ブロードキャスト系の名前解決（Windows 11 の場合は mDNS、LLMNR、NetBIOS の順）のみで名前解決が行われ、DNS で名前解決されないようだ
解決: `ping win.` のように FQDN を明示するか、win.local のように mDNS で引っかかるよう設定する
I think the WinNuke attacks against the SMB-adjacent NetBIOS protocol was a trigger for lots of places to begin locking that down
November 14, 2024 at 10:36 AM
I think the WinNuke attacks against the SMB-adjacent NetBIOS protocol was a trigger for lots of places to begin locking that down