Nbtscan

NBTScan

Purpose

Use this skill for lightweight NetBIOS name-service enumeration across approved internal ranges.

Phase Fit

• Primary: Discovery and Reconnaissance
• Secondary: Retest and Closure

Use When

• Need to identify Windows hosts by NetBIOS name.
• Need to correlate legacy name-service exposure with host inventory.
• Need a low-overhead retest after legacy service hardening.

Avoid When

• The target range is not explicitly approved.
• Legacy name-service testing is not relevant to the engagement.

Inputs

• Approved IP range or host list
• Rate and segmentation constraints
• Output handling needs

Procedure

1. Start with the smallest approved range.
2. Record only names and mappings that materially help later testing.
3. Correlate results with SMB and inventory data.
4. Preserve the exact range for retest.
5. Treat output as discovery context, not standalone impact proof.

Command Syntax

Replace sample targets with approved in-scope ranges.

# Scan a subnet for NetBIOS names
nbtscan 10.10.10.0/24

# Scan a range with verbose output
nbtscan -v 10.10.10.0/24

# Scan a specific host
nbtscan -v 10.10.10.100

# Set timeout (milliseconds)
nbtscan -t 2000 10.10.10.0/24

# Save output to file
nbtscan 10.10.10.0/24 > contoso-nbtscan.txt

Evidence to Capture

• NetBIOS name-to-host mappings relevant to the assessment
• Exact range and scan mode used
• Why the result materially affected follow-on testing

Safety Boundaries

• Keep scope limited to approved ranges.
• Use output only as bounded discovery context.