Enumeration · Module 04
enum4linux
Enumerate users, shares, groups and policies from SMB / Samba.
Safe to try on your own machine. Spin up your Kali Linux lab and practice away — on any system you own or have permission to test. That’s exactly how the pros learn.
Definition
enum4linux is a Linux-based enumeration tool that gathers information from Windows systems and Samba servers using SMB and related protocols.
Enumerate users, groups, shares, and other available information from SMB services.
Network reconnaissance, Windows environment assessment, and authorized penetration testing.
Key features
Attempts to identify user accounts exposed via SMB.
Discovers SMB shares and access information.
Retrieves group information when permitted.
Gathers OS and domain-related details.
May retrieve the password policy when allowed.
Important commands
enum4linux -hShow command-line help.
enum4linux -U <target>Attempt user enumeration.
enum4linux -S <target>Attempt SMB share enumeration.
enum4linux -G <target>Attempt group enumeration.
enum4linux -P <target>Attempt password policy enumeration.
enum4linux -a <target>Broad enumeration of supported categories.
Practical examples
enum4linux -U 192.168.1.10
Purpose Attempts to retrieve user account information.
enum4linux -S 192.168.1.10
Purpose Attempts to discover available SMB shares.
enum4linux -a 192.168.1.10
Purpose Runs multiple supported checks: users, groups, shares, domain and system info.
Important points
- SMB: Server Message Block is the protocol used for file sharing on Windows networks.
- Ports: SMB uses TCP 445; older NetBIOS SMB uses TCP 139 and UDP 137-138.
- Null sessions: Some info may be readable via unauthenticated SMB on misconfigured systems.
- Tool versions: Classic enum4linux and enum4linux-ng differ in syntax.
- Limitations: Failed enumeration does not mean the target is secure.
- Authorization: Run only against systems you are permitted to assess.
Common use cases
Gather info about Windows hosts and Samba servers.
Identify accounts exposed through SMB.
Find accessible network shares for authorized auditing.
Spot excessive information disclosure over SMB.
This tool is taught in Module 04
Read the full written notes, with diagrams, defense and detection.