312-50V9 · Question #522
Why would an attacker want to perform a scan on port 137?
The correct answer is D. To discover information about a target host using NBTSTAT. Port 137 is used by the NetBIOS Name Service, and querying it allows attackers to gather host information similar to what the NBTSTAT utility provides.
Question
Why would an attacker want to perform a scan on port 137?
Options
- ATo discover proxy servers on a network
- BTo disrupt the NetBIOS SMB service on the target host
- CTo check for file and print sharing on Windows systems
- DTo discover information about a target host using NBTSTAT
How the community answered
(16 responses)- A6% (1)
- D94% (15)
Why each option
Port 137 is used by the NetBIOS Name Service, and querying it allows attackers to gather host information similar to what the NBTSTAT utility provides.
Proxy servers are not associated with port 137; proxy detection typically involves ports like 8080, 3128, or 1080.
Port 137 is the NetBIOS Name Service used for name resolution, not the SMB session service used for file sharing disruption, which runs on port 139 or 445.
File and print sharing enumeration primarily occurs over port 139 (NetBIOS Session Service) or port 445 (SMB), not port 137.
Port 137 (UDP/TCP) is the NetBIOS Name Service port, which resolves NetBIOS names to IP addresses and exposes host information. Querying this port is functionally equivalent to running NBTSTAT, which can reveal the target's NetBIOS name table, logged-on users, MAC address, and workgroup or domain membership. Attackers use this reconnaissance technique to enumerate Windows hosts on a network.
Concept tested: NetBIOS Name Service port 137 reconnaissance
Source: https://learn.microsoft.com/en-us/windows-server/networking/technologies/wins/wins-top
Topics
Community Discussion
No community discussion yet for this question.