Pearson's OSCP Notebook

nbtscan

Properties1
tagsnbtscan, netbios, smb, enumeration, 137, 139, windows, oscp

2 min read

nbtscan — NetBIOS Name Scanner

nbtscan scans IP ranges for NetBIOS names — hostname, workgroup/domain, user hints, MAC address. Fast first pass when 137/139 or 445 are open.

Ctrl+F: nbtscan · NetBIOS · 137 · 139 · workgroup

When: SMB/NetBIOS ports open → map hostnames before nxc, enum4linux, Responder poisoning. Pair with UseCases for ports > Port 137-139 — NetBIOS.

Alternatives: nmblookup -A · nmap --script nbstat · enum4linux

Install (Kali)

sudo apt update && sudo apt install -y nbtscan

Verify: nbtscan -h

Full install index → Installation - Kali Setup

Usage

# Single host
nbtscan 10.10.10.10
 
# Subnet (reverse DNS lookup with -r)
nbtscan -r 10.10.10.0/24
 
# From file
nbtscan -f targets.txt
 
# Verbose
nbtscan -v 10.10.10.10

Sample output

10.10.10.10     CORP\DC01         <00> UNIQUE
10.10.10.10     CORP              <00> GROUP
10.10.10.10     DC01              <20> UNIQUE
FieldMeaning
<00> UNIQUEWorkstation / domain name registration
<00> GROUPWorkgroup or domain GROUP
<20> UNIQUEFile server service

Workflow

nmap -p 137,139,445 TARGET
    ↓
nbtscan -r 10.10.10.0/24
    ↓
Add names to /etc/hosts → enum4linux / nxc / smbclient

nbtscan -r 10.10.10.0/24
enum4linux -a 10.10.10.10
nxc smb 10.10.10.10 -u guest -p ''

NetBIOS NBT-NS (UDP 137) is what Responder poisons for NTLM captures — knowing NetBIOS names helps target internal hosts.

sudo responder -I eth0 -w On -v

Quick cheat sheet

nbtscan 10.10.10.10
nbtscan -r 10.10.10.0/24
nmblookup -A 10.10.10.10
nmap -p 137,139 --script nbstat 10.10.10.10

Graph View

Backlinks