• IP Range (Netmask and Inverted Netmask supported)
• IP List
• Single Host
• Neighborhood

• Determine OS using Server Message Block (SMB) Queries
  -PDC (Primary Domain Controlller)
  -BDC (Backup Domain Controller)
  -NT MEMBER SERVER
  -NT WORKSTATION
  -SQL SERVER - If found check for sa account with no password.
  -NOVELL NETWARE SERVER
  -WINDOWS FOR WORKGROUPS
  -WINDOWS 9X
  -DOMAIN\NetBIOS name
  
• Enumerate NetBIOS Shares
  Checks for shares accessible without password
  Including Administrative ($) Shares
  
• Enumerate Users
  
• Enumerate Services
  
• Enumerate Transports
  
• Obtain Security Identifier (SID) for computers, users, and groups.
  
• Enumerate Sessions
  
• Establish NULL IPC$ Sessions
  
• Service Pack & Hotfixes
  
• Enumerate Local and Global Groups and determines group memberships.
  
• Remote Time and Date
  
• TCP SYN & Non-Blocking TCP connect() Portscan (Grabs Banners)
  
• Non-Blocking UDP connect() Portscan
  
• ICMP and DNS Resolution Only scan hosts that respond to ICMP echo request.
  
• Enumerate Disks
  
  • Map Network Drive.
  • Launch default web browser against hosts running FTP and HTTP Services.
    
  • Explore NetBIOS Shares.
    
• Winfingerprint Help
  
• ChangeLog

Usage:
winfingerprintcli.exe <Scan Typei> <Options>
-------- Scan Type --------------------------------------------------------
-host <lhostname> Scan single hosts.
-l or -list <ip list>  Scan list of hosts.
-startip <ip address> -endip <ip address> Scan range of hosts.
-o or -output <filename> Output filename. (winfingerprint.txt by default).
-------- Options ----------------------------------------------------------
-a or -all         Equivalent to -shares -services -time -users -groups -disks
                   -ping -tcpscan -udpscan -fingerprint
                   NOTE: -all DOES NOT include -null -startport  or -endport.
-b or -shares      Enumerate NetBIOS shares.
-d or -disks       Enumerate disks.
-f or -fingerprint Determine OS.
-g or -groups      Enumerate groups.
-i or -time        Get Remote time and date.
-n or -null        Establish NULL IPC$ Sessions.
-p or -ping        Only hosts that respond to ICMP echo request are scanned.
-r or -registry    Read Service Pack and Hotfix Level from registry
-s or -sessions    Enumerate sessions.
-t or -transports  Enumerate transports.
-u or -users       Enumerate users.
-v or -services    Enumerate running Services.
-ad                Use Active Directory instead of NT Domain
-neighborhood <domain> Enumerate Network Neighborhood
-------- Port Scan Options -------------------------------------------------
-tcpscan           TCP portscan (Grabs Banners)
-udpscan           UDP portscan.
-tcpstartport <1-65535>         Default startport =  1
-tcpendport   <1-65535>         Default endport = 1024
-udpstartport <1-65535>         Default startport =  1
-udpendport   <1-65535>         Default endport = 1024
-timeout      <1-10> (seconds)  Default timeout =    3