Practical cybersecurity guides, labs & compliance
Understand why nbtscan can return a hostname without a share list. Separate NetBIOS name information from SMB enumeration, check the installed tool syntax and choose the next step from the operation that actually failed.
Report SMB signing support, requirements and observed session behavior as separate facts. Use the comparison record to preserve dialect, authentication and negotiation context without weakening policy to force a result.
Diagnose smbclient tree-connect failures with the exact share token, shell quoting, session identity and returned status. Use a single-change record to compare one evidenced input instead of changing several settings at once.
Separate smbclient share enumeration, share connection, directory listing and file reads. Compare requests under the same identity and conditions, then report the first failed operation without inferring untested permissions.
Record an rpcclient access denial at the specific procedure and account context that failed. Use the evidence card to distinguish connection success from per-call permissions and keep other successful queries within their own scope.
When rpcclient connects but user enumeration fails, record the exact call, identity and status. Use the operation coverage table to distinguish narrow successful queries from denied actions and retain the authorization boundary.
Compare SMB behavior on ports 139 and 445 using the same target, client, identity and operation. Preserve transport context and the first failure before attributing different results to dialect, signing or access policy.
Diagnose SMBMap logon failures with one approved account, explicit username and domain inputs, and an attempt ceiling. Use the comparison record to preserve changed conditions without turning formatting checks into credential guessing.
Diagnose a Kioptrix VM with no identified IP through host compatibility, named-network membership and MAC-linked address evidence. Review DHCP and guest-NIC questions separately, preserving the old settings before any documented reversible change.
Review the historical Samba CVE-2003-0201 advisory separately from the service running in your Kioptrix image. Use the applicability record to retain build, backport and architecture uncertainty before any expressly authorized test.