{
  "slug": "null-session-anonymous-access",
  "url": "https://library.infinity8labs.com/null-session-anonymous-access/",
  "title": "Null sessions and anonymous access to domain controllers",
  "short": "Null session",
  "aliases": [
    "Null authentication",
    "Anonymous logon",
    "Anonymous SMB and RPC enumeration",
    "Anonymous LDAP bind"
  ],
  "summary": "A domain controller accepts connections with no username or password and answers directory questions for them. Anyone who can reach it on the network can list users, groups and the password policy without a single credential.",
  "cwe": [
    "CWE-287",
    "CWE-200"
  ],
  "owasp": "A05:2021 Security Misconfiguration",
  "typical_severity": {
    "min": "medium",
    "max": "high"
  },
  "updated": "2026-10-19",
  "references": [
    {
      "title": "CWE-287: Improper Authentication",
      "url": "https://cwe.mitre.org/data/definitions/287.html"
    },
    {
      "title": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
      "url": "https://cwe.mitre.org/data/definitions/200.html"
    },
    {
      "title": "OWASP Top 10 A05:2021 Security Misconfiguration",
      "url": "https://owasp.org/Top10/A05_2021-Security_Misconfiguration/"
    },
    {
      "title": "Microsoft: Network access: Do not allow anonymous enumeration of SAM accounts and shares",
      "url": "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares"
    },
    {
      "title": "Microsoft: Network access: Restrict anonymous access to Named Pipes and Shares",
      "url": "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares"
    },
    {
      "title": "MITRE ATT&CK T1087.002 Account Discovery: Domain Account",
      "url": "https://attack.mitre.org/techniques/T1087/002/"
    },
    {
      "title": "CIS Benchmarks: Microsoft Windows Server",
      "url": "https://www.cisecurity.org/benchmark/microsoft_windows_server"
    }
  ],
  "sections": [
    "https://library.infinity8labs.com/null-session-anonymous-access/#overview",
    "https://library.infinity8labs.com/null-session-anonymous-access/#impact",
    "https://library.infinity8labs.com/null-session-anonymous-access/#examples",
    "https://library.infinity8labs.com/null-session-anonymous-access/#remediation",
    "https://library.infinity8labs.com/null-session-anonymous-access/#testing",
    "https://library.infinity8labs.com/null-session-anonymous-access/#references"
  ]
}