Use these commands only on systems and networks you own or are explicitly authorized to assess.

🪟 NetBIOS & Shares

Query a Remote NetBIOS Name Table

nbtstat -a target

-a displays the NetBIOS name table of the remote computer identified by name.

Display the Local NetBIOS Cache

nbtstat -c

-c displays the local computer’s NetBIOS name cache.

View Network Connections

net use

The output can show connected network resources, their status, and mapped shares or drives.

🌐 DNS Enumeration

Start an interactive nslookup session:

nslookup
set querytype=soa
domain.example

Setting the query type to SOA requests the Start of Authority record, which contains administrative information about the zone.

Within interactive nslookup, an authorized zone-transfer request can be attempted with:

server nameserver.domain.example
ls -d domain.example

Most properly configured public DNS servers refuse zone transfers. A successful unauthorized transfer indicates a serious configuration issue.