NetBIOS name resolution is enabled in most of Windows clients today and even a debugging utility called nbtstat
is shipped with Windows to diagnose name resolution problems with NetBIOS over TCP/IP. We can use NetBIOS to obtain useful information such as the computer name, user, and MAC address with one single request.
This recipe shows how to retrieve the NetBIOS information and MAC address of a Windows host with Nmap.
Open your terminal and enter the following Nmap command:
$ nmap -sU -p137 --script nbstat <target>
The NSE script nbstat
will return the NetBIOS name, NetBIOS user, and MAC address of the system:
PORT STATE SERVICE 137/udp open microsoft-ds MAC Address: 9C:2A:70:10:84:BF (Hon Hai Precision Ind.) Host script results: |_nbstat: NetBIOS name: ALIEN, NetBIOS user: <unknown>, NetBIOS MAC: 9C:2A:70:10:84:BF (Hon Hai Precision Ind.)