Enumeration · Module 04
NbtScan
Scan a network for NetBIOS names and MAC addresses.
Safe to try on your own machine. Spin up your Kali Linux lab and practice away — on any system you own or have permission to test. That’s exactly how the pros learn.
Definition
nbtscan is a command-line tool used to query NetBIOS name information from Windows systems and other devices that support NetBIOS over TCP/IP.
Discover NetBIOS names, computer names, workgroups, and related network information.
Network reconnaissance, Windows network discovery, and authorized security assessments.
Key features
Retrieves available NetBIOS name information.
Helps identify hostnames on legacy Windows networks.
May reveal workgroup or domain names.
Scans many IP addresses in a range.
Supports terminal scanning and scripting.
Important commands
nbtscan -hShow help and options.
nbtscan 192.168.1.10Query NetBIOS info from one IP.
nbtscan 192.168.1.0/24Scan an entire subnet.
nbtscan -v 192.168.1.10Verbose output (where supported).
nbtscan -r 192.168.1.0/24Use NetBIOS status queries over the range.
Practical examples
nbtscan 192.168.1.10
Purpose Queries the target for NetBIOS name info.
nbtscan 192.168.1.0/24
Purpose Scans the subnet for systems responding to NetBIOS.
nbtscan -r 192.168.1.0/24
Purpose Uses the NetBIOS status query option across the range.
Important points
- NetBIOS: A legacy interface for name services on some local networks.
- UDP 137 / TCP 139: 137 = NetBIOS Name Service; 139 = older SMB over NetBIOS.
- Modern networks: Many use DNS and SMB over TCP 445 without NetBIOS.
- Firewall restrictions: Firewalls may block NetBIOS and prevent discovery.
- Authorization: Scan only systems you are permitted to assess.
Common use cases
Identify NetBIOS-enabled hosts.
Collect available computer names.
Discover exposed workgroup information.
Assess unnecessary NetBIOS exposure.
This tool is taught in Module 04
Read the full written notes, with diagrams, defense and detection.