NBTScan

Information Gathering

Beginnerlow risk

NBTScan is a program for scanning IP networks for NetBIOS name information. It sends a NetBIOS status query to each address in the supplied range and lists received information in human-readable form.

Installation

sudo apt install nbtscan

Basic Syntax

nbtscan [options] <target_range>

Quick Facts

Full Name

NBTscan

License

GPLv2

Author

Andrew Tridgell / Vladimir Dubrovin

Written In

C

Platforms

Linux, macOS

Category

NetBIOS Enumeration

Protocol

NetBIOS over TCP/IP

Tool Overview

NBTscan is a tool for scanning IP networks to discover NetBIOS name information. It sends NetBIOS status queries to target hosts and displays computer names, user accounts, MAC addresses, and shared resources.

NetBIOS is a protocol used by Windows machines for local network communication. When enabled, it exposes system information that can be used for network mapping and identifying potential targets during penetration tests.

NBTscan is particularly useful for discovering Windows machines on a subnet, identifying logged-in users, and finding shared resources. Its speed and simplicity make it a quick way to map Windows network environments.

Common Commands

nbtscan 192.168.1.0/24Subnet lookup - Query every node on a subnet for NetBIOS names and MAC addresses

nbtscan 192.168.1.100Single host - Query NetBIOS name information for one target

nbtscan -r 192.168.1.0/24Source port 137 - Use the NetBIOS source port for firewall-restricted networks

nbtscan -v 192.168.1.100Verbose - Show the full NetBIOS name table for a host

nbtscan -f targets.txtFile input - Scan a list of IPs or ranges from a file

nbtscan -O results.txt 192.168.1.0/24Output file - Write scan results to a file

nbtscan -s : 192.168.1.0/24Script mode - Colon-delimited output for parsing in scripts

nbtscan -m 192.168.1.0/24MAC only - Include the human-readable MAC address in output

nbtscan -h 192.168.1.0/24Human readable - Print service names in verbose human-readable form

nbtscan -t 500 192.168.1.0/24Timeout - Set the per-host response wait time in milliseconds

nbtscan 192.168.1.0/24Scan network for NetBIOS names

nbtscan -r 192.168.1.0/24Resolve discovered names to IPs

nbtscan -v 192.168.1.0/24Verbose output with details

nbtscan -a 192.168.1.0/24Show all NetBIOS name types

nbtscan -s : 192.168.1.0/24Use space delimiter

Step-by-Step Guide

1Specify the network subnet you want to investigate
2Execute the tool against that range
3Review the output for machine names and currently logged-in users
4Use SMBClient to test share access on Windows hosts identified by NBTScan
5Leverage these NetBIOS details to plan targeted attacks on specific workstations

Warnings

Scanning networks without authorization may violate local computer access laws
NetBIOS broadcasts can be detected by network monitoring tools on the same subnet
Only scan networks you own or have explicit written permission to test
Results may expose sensitive information about Windows network configurations
Use findings responsibly and do not attempt unauthorized access to discovered hosts

Use Cases

Windows Network Discovery

Find all Windows machines on a subnet through NetBIOS queries.

User Enumeration

Discover logged-in users on Windows machines.

Share Discovery

Identify shared resources and folders on Windows hosts.

Network Mapping

Map Windows network topology through NetBIOS data.

Key Features

Fast Subnet Scanning: Scan entire subnets in seconds for NetBIOS hosts.
NetBIOS Name Resolution: Extract computer names and domain information.
User Discovery: Identify logged-in users on Windows machines.
MAC Address Display: Show MAC addresses for discovered hosts.
File Input: Scan targets from a file for automation.

Related Tools

Enum4linux

Information Gathering

Comprehensive SMB/NetBIOS enumeration.

Frequently Asked Questions

What is NBTscan used for?

NBTscan is used for scanning networks to find NetBIOS name information. It discovers Windows machines on a subnet by querying NetBIOS name tables, revealing computer names, users, and services.

What is NetBIOS?

NetBIOS (Network Basic Input/Output System) is a protocol used by Windows for local network communication. It exposes computer names, user accounts, and shared resources.

Does NBTscan work on Linux?

NBTscan runs on Linux but scans Windows/Samba machines. It queries NetBIOS information from Windows hosts on the network.

How do I install NBTscan?

Install NBTscan using: sudo apt install nbtscan on Kali Linux or Debian-based systems. On other Linux distributions, use your package manager or compile from source. NBTscan runs on Linux and macOS.

How do I use NBTscan to scan a subnet?

Run nbtscan -r 192.168.1.0/24 to scan a subnet. The -r flag specifies the target range. NBTscan will query each host and display NetBIOS names, users, and MAC addresses.

What are the most common NBTscan commands?

Common commands include: nbtscan -r 192.168.1.0/24 (scan subnet), nbtscan -r 192.168.1.1-254 (scan IP range), nbtscan -f targets.txt (scan from file), and nbtscan -r 192.168.1.0/24 -v (verbose output).

Does NBTscan require root privileges?

NBTscan does not require root privileges for basic scanning. However, some features like raw socket operations may need elevated permissions. Run without sudo for standard NetBIOS queries.

How does NBTscan compare to enum4linux?

NBTscan is faster for quick NetBIOS discovery across subnets. enum4linux provides deeper SMB/NetBIOS enumeration including user details, shares, and policies. Use NBTscan for initial discovery; enum4linux for detailed enumeration.

How does NBTscan compare to nmap?

NBTscan focuses specifically on NetBIOS name resolution for Windows networks. Nmap provides broader network scanning including port detection, service detection, and OS fingerprinting. Use NBTscan for NetBIOS-specific tasks; Nmap for comprehensive scanning.

Is NBTscan legal to use?

NBTscan itself is legal software. However, scanning networks without permission from the owner may violate laws. Always obtain written authorization before scanning networks you don't own or manage.

What information does NBTscan reveal?

NBTscan reveals NetBIOS names, logged-in users, MAC addresses, and server status. The output shows IP address, NetBIOS name, domain/workgroup, and user information for each discovered host.

Why is NBTscan not finding any hosts?

NBTscan only finds Windows/Samba machines with NetBIOS enabled. Linux hosts, IoT devices, and modern Windows systems with NetBIOS disabled won't appear. Ensure targets are on the same subnet and have NetBIOS enabled.

How do I interpret NBTscan output?

NBTscan output shows IP address, NetBIOS name, server type, logged-in user, and MAC address. Server type codes indicate the role: workstation, server, or domain controller. Use this information to identify high-value targets.

What is the -r flag in NBTscan?

The -r flag specifies the target range for scanning. Use CIDR notation (192.168.1.0/24) or IP range (192.168.1.1-254) to define the hosts to scan.

Can NBTscan scan across subnets?

NBTscan works best on the local subnet because NetBIOS broadcasts don't cross routers. For remote subnets, you need to run NBTscan from a machine on each target subnet or use a VPN.

How do I save NBTscan results to a file?

Use the -o flag to save results: nbtscan -r 192.168.1.0/24 -o output.txt. This saves the scan results to a text file for later analysis and documentation.

What is the NetBIOS name table?

The NetBIOS name table is a list of names registered by a Windows machine for network communication. It includes the computer name, domain/workgroup, and services. NBTscan queries this table to discover host information.

How long does an NBTscan scan take?

A typical NBTscan scan of a /24 subnet completes in 10-30 seconds. The speed depends on network conditions and the number of hosts. NBTscan is one of the fastest tools for NetBIOS discovery.

Output Explanation

NBTScan output displays NetBIOS name table information for each host on the network. Results include IP address, NetBIOS name, server status, logged-in users, and MAC addresses. The name type codes indicate the role of each machine (workstation, server, domain controller).

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.