# Nbtscan

> Use for NetBIOS name enumeration during authorized internal pentests. Trigger on Windows host discovery, hostname to IP correlation, and validating legacy name-service exposure inside approved ranges.

- Skill: `timsonner/nbtscan` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/nbtscan`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/nbtscan/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/nbtscan

---


# NBTScan

## Purpose

Use this skill for lightweight NetBIOS name-service enumeration across approved internal ranges.

## Phase Fit

- Primary: Discovery and Reconnaissance
- Secondary: Retest and Closure

## Use When

- Need to identify Windows hosts by NetBIOS name.
- Need to correlate legacy name-service exposure with host inventory.
- Need a low-overhead retest after legacy service hardening.

## Avoid When

- The target range is not explicitly approved.
- Legacy name-service testing is not relevant to the engagement.

## Inputs

- Approved IP range or host list
- Rate and segmentation constraints
- Output handling needs

## Procedure

1. Start with the smallest approved range.
2. Record only names and mappings that materially help later testing.
3. Correlate results with SMB and inventory data.
4. Preserve the exact range for retest.
5. Treat output as discovery context, not standalone impact proof.

## Command Syntax

Replace sample targets with approved in-scope ranges.

```bash
# Scan a subnet for NetBIOS names
nbtscan 10.10.10.0/24

# Scan a range with verbose output
nbtscan -v 10.10.10.0/24

# Scan a specific host
nbtscan -v 10.10.10.100

# Set timeout (milliseconds)
nbtscan -t 2000 10.10.10.0/24

# Save output to file
nbtscan 10.10.10.0/24 > contoso-nbtscan.txt
```

## Evidence to Capture

- NetBIOS name-to-host mappings relevant to the assessment
- Exact range and scan mode used
- Why the result materially affected follow-on testing

## Safety Boundaries

- Keep scope limited to approved ranges.
- Use output only as bounded discovery context.