How to use enum4linux for Network Infrastructure VAPT?
Quick answer: enum4linux is a command-line tool that asks Windows and Samba systems what they will reveal over SMB, such as users, shares, groups and the password policy. Use it only on systems you have written permission to test, and treat what it finds as evidence to report and fix, not a list to attack.
During a network vulnerability assessment and penetration test, one of the first questions is: what does this host tell an unauthenticated visitor? Windows and Samba systems that expose SMB can answer more than they should, and enum4linux is a quick way to see it.
This guide covers authorisation first, then the commands, how to read the output, and how defenders close the gaps. The IP addresses used are examples, so replace them with the in-scope targets from your agreement.
CyberSapiens delivers vulnerability assessment and penetration testing. This article is general information for authorised testers and the teams being tested.
Before You Run Anything: Authorisation
The tool is easy to run, which is exactly why this comes first. Both enum4linux-ng’s own notice and its usage text say it is for security professionals and CTF players and that illegal use is prohibited.
1. Written permission
A signed authorisation from someone with the authority to approve testing of those systems. Verbal agreement is not enough.
2. Defined scope
A list of in-scope IP ranges and hosts, and what is excluded. Do not run a tool against anything outside it.
3. Rules of engagement
Testing windows, allowed techniques, emergency contacts and a stop condition, agreed before the first command.
4. Care with active checks
Some options do more than read. For example, enum4linux’s aggressive mode (-A) performs write checks on shares, so only use it when the agreement covers it.
5. Evidence handling
Record the commands you run and when. Store results securely because they can contain usernames and share names.
6. Legal position
Unauthorised access to computer systems is an offence in Australia and most other countries. Take legal advice if your authority to test is unclear.
If you are the client, ask your tester for this paperwork. A provider that skips it is a warning sign.
What enum4linux Is, and What It Is Not
enum4linux is a Perl tool for enumerating information from Windows and Samba systems. It is a wrapper around the Samba tools smbclient, rpcclient, net and nmblookup, so it does not add new access. It runs those tools for you and collects the results. See its entry on Kali Linux Tools.
Two points affect how you use it:
It shows what the host allows
If a system blocks anonymous access, the output will be mostly empty. That is a good result for the client, not a tool failure.
There is a newer rewrite
enum4linux-ng is a rewrite that can write results to JSON or YAML, runs RID cycling more efficiently and uses different option names. See its project page. Both tools depend on the Samba client tools.
enum4linux is not a vulnerability scanner. It reports what the host discloses over SMB. It does not tell you whether the host is patched or whether a vulnerability exists.
enum4linux Commands and Options
The table lists the common options as documented for the Kali package (version 0.9.1). Run enum4linux -h on your own system to confirm what your version supports.
| Command | What it does | Notes |
|---|---|---|
nmap -p139,445 --script smb-os-discovery 192.168.1.0/24 | Find hosts with SMB open and identify OS, computer name, domain and workgroup (Nmap uses ports 445 or 139). | Use only the in-scope range. The option is –script with two hyphens. |
enum4linux -a <target> | Runs the simple enumeration set: users, shares, groups, password policy, RID cycling, OS, nmblookup and printers. This is the default with no options. | Noisy. Check scope before using it. |
enum4linux -U <target> | Lists user accounts. | Shows which accounts are visible without credentials. |
enum4linux -S <target> | Lists shares. | Add -d for more detail on users and shares. |
enum4linux -P <target> | Retrieves the password policy. | Compare it with the client’s policy, not an outside benchmark. |
enum4linux -G <target> | Lists groups and members. | Look for exposure of privileged group membership. |
enum4linux -o -n <target> | -o gets OS information and -n runs an nmblookup. | Useful for the asset inventory. |
enum4linux -u <user> -p <pass> -a <target> | Runs enumeration with credentials you were given. | Only use credentials supplied in scope. |
enum4linux -v <target> | Verbose mode, shows the underlying commands being run. | Good for your evidence log. |
enum4linux-ng Equivalents
| Command | What it does |
|---|---|
enum4linux-ng -A <target> | Standard enumeration including nmblookup, the default with no option. |
enum4linux-ng -As <target> | The same without the NetBIOS names lookup. |
enum4linux-ng -U -G -S -P <target> | Users, groups, shares and password policy over RPC. |
enum4linux-ng -A -oJ results <target> | Writes results to a JSON file (the extension is added automatically). |
enum4linux-ng -A -u <user> -w <domain> <target> | Uses a supplied username and sets the workgroup or domain manually. |
Group members are not enumerated by default in enum4linux-ng. They are enabled with -Gm, and RID cycling with -R. Check the project page for the current options.
Reading the Results and Reporting Them
Output matters only when it becomes a finding the client can act on. The table below is illustrative, not real output.
| Output area | What it tells you | What to do with it |
|---|---|---|
| Users | Which accounts an unauthenticated visitor can see, and whether privileged or service accounts appear. | Report the exposure and the access method. Recommend restricting anonymous enumeration. |
| Shares | Which shares exist and who can read or write to them. | Confirm access levels with the client before opening anything. Report shares that hold sensitive data. |
| Password policy | Minimum length, complexity and lockout settings. | Compare with the client’s own standard and report gaps. |
| Groups | Which groups exist and whether privileged group membership is visible. | Report visibility of privileged membership as a finding. |
| OS and domain | System version, computer name and domain details. | Use for asset inventory and to prioritise patch review. |
If the Output Is Empty
Empty or denied results usually mean the host does not allow anonymous access, or a firewall is blocking SMB from your position. Do not treat that as a failed test. Record it as a positive result, then continue only with the credentials and techniques the scope allows.
Avoid turning findings into an attack list in the report. Describe the exposure, the risk and the fix. Exploitation belongs only where the rules of engagement allow it.
For Defenders: Closing the Gaps
If you are on the receiving end of a test, these steps address the usual findings. Read Microsoft’s page on the anonymous enumeration setting before changing it, because the right choice depends on your environment.
1. Restrict anonymous enumeration
Microsoft’s policy setting “Network access: Do not allow anonymous enumeration of SAM accounts” controls whether anonymous users can list account names. Microsoft lists Enabled as the recommended value, and notes it has no effect on domain controllers and can affect very old clients.
2. Limit SMB exposure
Allow SMB only between systems that need it, and keep it off networks it does not need to reach.
3. Review shares and permissions
List every share, remove unused ones and give each the least access it needs.
4. Set and enforce a password policy
Match length, complexity and lockout settings to your own standard, and review them regularly.
5. Monitor for enumeration
Log and alert on repeated anonymous or failed SMB and RPC connections.
6. Retest after fixing
Run the same checks again to confirm the exposure is gone.
For wider testing, see our guide to the advantages and limits of penetration testing and how to scope an engagement.
Content Reviewed By
Ketki Tidke
Cyber Security and GRC Lead Auditor
ISO 27001 Lead Auditor
Ketki is a certified ISO 27001 Lead Auditor specialised in Governance, Risk and Compliance, with experience consulting public, private, and government clients. She evaluates threats, risk impacts, and regulatory requirements across multiple industry frameworks.
enum4linux: Frequently Asked Questions
What is enum4linux used for?
It enumerates information from Windows and Samba systems over SMB, such as users, shares, groups and the password policy, so testers can see what a host discloses.
Is it legal to use enum4linux?
Only on systems you have written permission to test. Unauthorised access to computer systems is an offence in Australia and most countries, so keep your scope and authorisation on file.
What is the difference between enum4linux and enum4linux-ng?
enum4linux-ng is a rewrite that adds JSON and YAML output, faster RID cycling and different option names. Both wrap the Samba client tools.
Why does enum4linux return nothing?
The host may block anonymous access, or a firewall may block SMB from your position. Record it as a positive result and continue only with the access your scope allows.
Is enum4linux enough for a network penetration test?
No. It covers one protocol and reports what the host discloses. A full test also covers patching, services, configuration and, where in scope, exploitation.
How do I stop anonymous SMB enumeration?
Review the Microsoft policy setting that restricts anonymous enumeration of accounts, limit SMB exposure, and retest. Check effects on older clients before changing it.
Need an Authorised Network Penetration Test?
Talk to CyberSapiens about scope, rules of engagement and retesting for your network. We will help you decide what to test and how to act on the findings.
Email us
[email protected]Our head office
Lvl 1 206 Lorimer St, Port Melbourne, 3207
