NetBIOS Name Enumeration
1 min read
Created Jan 4, 2026
Last updated Aug 11, 2026
NetBIOS over 137/UDP leaks hostnames, workgroups, and MACs on legacy networks.
nbtscan Discovery
Single host:
┌──(kali㉿kali)-[~]
└─$ nbtscan $TARGET_IP
Range sweep:
┌──(kali㉿kali)-[~]
└─$ nbtscan $TARGET_SUBNET/24
Shows NetBIOS names and types.
nmblookup Query
Name resolution:
┌──(kali㉿kali)-[~]
└─$ nmblookup -A $TARGET_IP
Dumps full table including workgroup.
Common NetBIOS Name Types
The suffix byte in each record identifies the service behind the name:
<00>Workstation Service (hostname)<03>Messenger Service (logged-in user)<20>Server Service (file sharing active)<1D>Master Browser<1B>Domain Master Browser (PDC)