PAGES
← all tools
◆ Reconnaissance & OSINT

smbmap

v1.10.5 open-source

Enumerates Samba share drives across networks, supporting share listing, permission checks, file upload/download, and remote command execution.

source ↗ rss ↗ What is a cyber toolchain?

Summary

smbmap is an open-source command-line tool that enumerates Samba shares across a Windows domain, listing drives, permissions, and share contents, with support for uploading, downloading, and deleting files and executing remote commands. It is free to use, installed via pip, and run directly from a terminal against a host or a file of hosts. The README frames it explicitly for penetration testers, useful for spotting writable shares and sensitive files across large networks rather than for ongoing monitoring. It also supports pass-the-hash and KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. authentication, SMB signing detection, and regex-based content searching across shares, putting it alongside other SMB enumeration utilities used during internal network assessments rather than any named competitor. First committed in 2014 and still maintained by 21 contributors, though activity has slowed to two commits in the past year and the last release was over seven months ago.

Enumerates Samba share drives across networks, supporting share listing, permission checks, file upload/download, and remote command execution.

How smbmap helps

Which shares across these hosts let me read or write files I shouldn't be able to touch?

connects with the given credentials (or a null session) and lists every share alongside its permission level, flagging READ and WRITE access so writable shares stand out immediately

Where in this pile of shares is the sensitive file I'm looking for?

walks share contents recursively, matching file names against a pattern or searching file contents by regex across every host, so a single pass surfaces the file wherever it sits

Can I get into these hosts without a working password?

authenticates with a password hash or a Kerberos ticket instead of a cleartext password, and separately reports whether a null session succeeds, so access routes short of a real password are visible

Which of these servers would let an attacker relay or downgrade an SMB connection?

checks each host for SMB signing support and reports it per host, marking targets where the protection is absent

Is this foothold enough to run commands on the target, not just read files?

attempts remote command execution through the established session and returns the output, showing whether the access level reaches beyond file listing

Which hosts on this list are even worth investigating by hand?

works through a file of IPs, hostnames, or CIDR ranges and reports per host how many sessions were established and authenticated, separating hosts that answered but denied access from ones that yielded real share access

all 7 features, with the evidence for each →

Languages

Not documented

Features

7 capabilities · 2 backed by code, an API document or a real run

Built from smbmap's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

  • smbmap covers 1 of the 13 network discovery and scanning capabilities we track.

What smbmap offers you

  • Command-line interface3
  • CSV data export1
Attack surface inventory 3 features Network discovery and scanning since 2023
SMB host and share enumeration verified Discovers SMB hosts, establishes null or authenticated sessions, and enumerates available shares along with their access permissions. 1 release · 4 other sources · first seen Sep 2024

Shared capability: Attack surface inventory

release

we ran it

  • One host was detected serving SMB, with 1 null session established and 0 authenticated sessions. Aug 2026 · the full run
  • The tool detected one SMB host accepting a NULL session and enumerated three shares: public (READ, WRITE), private (NO ACCESS), and IPC$ (NO ACCESS, identified as a CTK fixture Samba service). Aug 2026 · the full run
  • The tool detected 1 host serving SMB and established 1 connection but achieved 0 authenticated sessions, resulting in access denied on the target. No shares were enumerated. Aug 2026 · the full run

example

  • Search file contents across multiple hosts python smbmap.py --host-file ~/Desktop/smb-workstation-sml.txt -u NopSec -p 'NopSec1234!' -d widgetworld -F '[1-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9][0-9][0-9]'
Host and network scanning shipped Scans specific IPs, CIDR blocks, or mixed input files to identify targets, with support for threaded execution to improve performance. 2 releases · 3 other sources · first seen May 2023

Shared capability: Attack surface inventory

Also counts toward: Command-line interface

release

  • Added threaded execution to specific functions, way faster v1.9.1 · May 2023 · source · release history
  • Host input files now support IPs, CIDR, and host names (one per line still) v1.9.1 · May 2023 · source · release history

example

  • Scan a single IP address directly from the command line without resolving it first. smbmap -H 192.168.1.100 -u user v1.9.1 · May 2023 · source
  • Scan an entire CIDR block by passing the network range directly in the host input file or command. smbmap -H 192.168.1.0/24 -u user v1.9.1 · May 2023 · source
  • Use a host input file containing mixed IPs, CIDRs, and hostnames to leverage the new threaded execution for faster results. cat hosts.txt | smbmap -f - -u user v1.9.1 · May 2023 · source
Recursive directory listing verified Recursively lists directories and files on enumerated shares, with a configurable timeout to bound the operation. 3 other sources · first seen Jan 2026

Shared capability: Attack surface inventory

Also counts toward: Command-line interface

command line

  • --list-dir-timeout — Specifcy a timeout (in seconds) before the recursive list dir and file terminates. Default is 0 (No timeout). v1.10.8 · Jan 2026 · command-line history

example

  • Scan hosts for SMB signing support ./smbmap.py --host-file local.txt --signing
  • List share contents non-recursively ./smbmap.py -H 192.168.86.214 -u Administrator -p asdf1234 -r c$ -q
Other / not yet classified 4 features Features we have not matched to a capability yet. A suggested match is marked.
CSV export and pattern filtering shipped Exports share lists, signing status, and other details to CSV format, with the ability to filter results by specific patterns. 3 releases · 4 other sources · first seen May 2024

Also counts toward: CSV data export

release

  • Adds --csv flag to output version, smb signing status, shares, and path listing v1.10.4 · May 2024 · source · release history
  • CSV output can now be combined with --pattern for filtered results v1.10.4 · May 2024 · source · release history
  • Enables combining --pattern matching with CSV output, which was previously mutually exclusive v1.10.3 · May 2024 · source · release history

example

  • Export share list and signing status to a CSV file for analysis smbmap -H <target_host> --csv > shares.csv v1.10.4 · May 2024 · source
  • List only shares matching a specific pattern and export to CSV smbmap -H <target_host> -p 'ADMIN*' --csv v1.10.4 · May 2024 · source
  • Export share and signing details for a target host into a spreadsheet-friendly format. smbmap -H <target_host> -u <username> -p <password> --output-format csv v1.10.3 · May 2024 · source
  • Filter shares matching a specific pattern and export the results to CSV. smbmap -H <target_host> -u <username> -p <password> --pattern 'ADMIN' --output-format csv v1.10.3 · May 2024 · source
Kerberos authentication support shipped Enables authenticated scans and connections using Kerberos protocol instead of password hashes. 2 releases · 1 other source · first seen Nov 2023

Also counts toward: Command-line interface

release

example

  • Authenticate to an SMB share using Kerberos instead of password hashes. smbmap -H target -u user -d domain --kerberos v1.10 · Nov 2023 · source
SMB signing detection shipped suggested Detects and reports the SMB signing status of target hosts during enumeration. 2 releases · first seen Nov 2023

Suggested capability: Attack surface inventory. This is our guess, not confirmed.

release

  • Adds --sign or implicit detection logic to identify SMB signing status on targets v1.10.2 · Nov 2023 · source · release history
  • Adds SMB signing detection capability v1.10 · Nov 2023 · source · release history
Remote command execution and file search shipped Executes commands on remote hosts and searches file contents across multiple targets. 1 other source

example

  • Execute remote command on target host python smbmap.py -u ariley -p 'P@$$w0rd1234!' -d ABC -x 'net group "Domain Admins" /domain' -H 192.168.2.50

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for smbmap, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail smbmap puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

6 entries

  1. September 20241
  3. May 20242
  6. November 20232
  9. May 20231

    6 entries

    1. v1.10.5 Sep 6, 2024 · release notes

      smbmap v1.10.5 adds host info to cmd output and fixes SMB signing detection for unauthenticated scans.

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.10.5 https://github.com/ShawnDEvans/smbmap.git
# already have the repo? check out this version:
$ git checkout v1.10.5
      • Adds the host to cmd output

      1 detail in Everything

    2. v1.10.4 May 29, 2024 · release notes

      smbmap v1.10.4 adds CSV output for version, smb signing, shares, and paths; enables CSV with pattern matching

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.10.4 https://github.com/ShawnDEvans/smbmap.git
# already have the repo? check out this version:
$ git checkout v1.10.4
      └──▷ USE IT
      Export share list and signing status to a CSV file for analysis
      shell 
      smbmap -H <target_host> --csv > shares.csv
      List only shares matching a specific pattern and export to CSV
      shell 
      smbmap -H <target_host> -p 'ADMIN*' --csv
      • Adds --csv flag to output version, smb signing status, shares, and path listing
      • CSV output can now be combined with --pattern for filtered results

      2 details in Everything

    3. v1.10.3 May 23, 2024 · release notes

      smbmap v1.10.3 adds CSV export for version, signing, shares, and path listing

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.10.3 https://github.com/ShawnDEvans/smbmap.git
# already have the repo? check out this version:
$ git checkout v1.10.3
      └──▷ TRY IT
      Export share and signing details for a target host into a spreadsheet-friendly format.
      $ smbmap -H <target_host> -u <username> -p <password> --output-format csv
      Filter shares matching a specific pattern and export the results to CSV.
      $ smbmap -H <target_host> -u <username> -p <password> --pattern 'ADMIN' --output-format csv
      • Enables combining --pattern matching with CSV output, which was previously mutually exclusive

      1 detail in Everything

    4. v1.10.2 Nov 24, 2023 · release notes

      smbmap v1.10.2 adds KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. auth, SMB signing detection, and improved session aggregation

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.10.2 https://github.com/ShawnDEvans/smbmap.git
# already have the repo? check out this version:
$ git checkout v1.10.2
      • Adds Kerberos authentication support for authenticated scans
      • Adds --sign or implicit detection logic to identify SMB signing status on targets
      • Improves output aggregates to distinguish between total SMB Connections vs active SMB Sessions

      3 details in Everything

    5. v1.10 Nov 22, 2023 · release notes

      SMBMap v1.10 adds KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. auth support and SMB signing detection

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.10 https://github.com/ShawnDEvans/smbmap.git
# already have the repo? check out this version:
$ git checkout v1.10
      └──▷ USE IT
      Authenticate to an SMB share using Kerberos instead of password hashes.
      shell 
      smbmap -H target -u user -d domain --kerberos
      • Adds --kerberos flag for Kerberos authentication
      • Adds SMB signing detection capability

      2 details in Everything

    6. v1.9.1 May 19, 2023 · release notes

      smbmap v1.9.1 adds threaded execution and allows IPs, CIDRs, and hostnames in input files

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.9.1 https://github.com/ShawnDEvans/smbmap.git
# already have the repo? check out this version:
$ git checkout v1.9.1
      └──▷ USE IT
      Scan a single IP address directly from the command line without resolving it first.
      shell 
      smbmap -H 192.168.1.100 -u user
      Scan an entire CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. block by passing the network range directly in the host input file or command.
      shell 
      smbmap -H 192.168.1.0/24 -u user
      Use a host input file containing mixed IPs, CIDRs, and hostnames to leverage the new threaded execution for faster results.
      shell 
      cat hosts.txt | smbmap -f - -u user
      • Host input files now support IPs, CIDR, and host names (one per line still)
      • Added threaded execution to specific functions, way faster

      2 details in Everything

    Project health

    Issue, contributor and maintainer activity in ShawnDEvans/smbmap, 2023-12 – 2026-11, as of 2026-11-03. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 1 −2 vs prior 12 months
    2. Maintainers 0 +0 joined · −1 left, last 12 months
    3. Bus factor 0 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close 212 days first maintainer reply 2.4 days
    6. Open backlog 22 of 76 issues ever filed
    1. Issues opened / month 1 · 0 communitymaintainers
    2. Open backlog 22
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 2,082
    Issue themes, last 12 months
    • other 100%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback