GO KALI FREE

enum4linux-ng

Information Gathering

Intermediatemedium risk

enum4linux-ng is a next-generation version of the classic enum4linux script, rewritten from scratch in Python 3 to parse and enumerate Windows/Samba information efficiently with cleaner output formats.

Installation

sudo apt install enum4linux-ng

Basic Syntax

enum4linux-ng [options] <target>

Quick Facts

Full Name
enum4linux-ng
License
GPL
Language
Python 3
Protocol
SMB/CIFS
Category
SMB Enumeration
Successor
enum4linux (Perl)

Tool Overview

enum4linux-ng is a next-generation SMB enumeration tool rewritten in Python 3. It efficiently enumerates Windows and Samba systems, extracting user accounts, shares, groups, policies, and system information.

The tool tests for anonymous logins, enumerates users and groups, lists available shares, extracts password policies, and gathers OS and domain information through the SMB protocol.

It supports JSON output for automated workflows and provides cleaner, more parseable results than the original Perl-based enum4linux. It is essential for Windows network penetration testing.

Common Commands

enum4linux-ng -A 192.168.1.1Full enumeration scan - Automatically run all automated enumeration checks using the clean python execution engine
enum4linux-ng 192.168.1.1Full enumeration
enum4linux-ng 192.168.1.1 -AAll options
enum4linux-ng 192.168.1.1 -u user -p passAuthenticated
enum4linux-ng 192.168.1.1 -oJ output.jsonJSON output
enum4linux-ng 192.168.1.1 -UEnumerate users
enum4linux-ng 192.168.1.1 -SEnumerate shares
enum4linux-ng 192.168.1.1 -GEnumerate groups
enum4linux-ng 192.168.1.1 -PPassword policy
enum4linux-ng 192.168.1.1 -CCommon configurations
enum4linux-ng 192.168.1.1 -u user -p passAuthenticated enumeration
enum4linux-ng 192.168.1.1 -u admin -p pass -AFull authenticated scan
enum4linux-ng 192.168.1.1 -oJ output.jsonJSON export
enum4linux-ng 192.168.1.1 -oX output.xmlXML export
enum4linux-ng 192.168.1.1 -vVerbose output

Step-by-Step Guide

  1. 1Test for anonymous login access initially
  2. 2Execute the comprehensive scan to gather all possible data metrics
  3. 3Incorporate valid credentials if you have acquired them to bypass access restrictions
  4. 4Carefully read the parsed output detailing accounts, policies, and file shares
  5. 5Use SMBClient to verify access to shares discovered by enum4linux-ng
  6. 6Save the formatted output files for reporting purposes

Warnings

Use Cases

SMB Enumeration

Discover users, shares, and groups on Windows/Samba targets.

Anonymous Login Check

Test for null session access on SMB services.

Password Policy Audit

Extract password policies to assess security posture.

Domain Enumeration

Gather domain and workstation information from Active Directory.

Key Features

Related Tools

smbclient

Information Gathering

Interactive SMB client for share access.

nbtscan

Information Gathering

NetBIOS name scanner for network discovery.

Frequently Asked Questions

What is enum4linux-ng used for?

enum4linux-ng is used for enumerating information from Windows/Samba systems via SMB. It discovers users, shares, groups, policies, and system information from target machines.

How does enum4linux-ng differ from enum4linux?

enum4linux-ng is a complete rewrite in Python 3 with cleaner output, JSON export support, and better parsing. It provides the same functionality as the original Perl-based enum4linux with modern improvements.

What information can enum4linux-ng extract?

It can extract user accounts, share listings, group memberships, password policies, OS information, hostnames, and domain details from SMB targets.

Can enum4linux-ng detect anonymous logins?

Yes, enum4linux-ng automatically tests for null session (anonymous login) access and reports whether the target allows unauthenticated SMB access.

How do I install enum4linux-ng?

Install enum4linux-ng using: sudo apt install enum4linux-ng on Kali Linux. On other systems, clone from GitHub and install dependencies: git clone https://github.com/cddmp/enum4linux-ng && pip install -r requirements.txt.

How do I use enum4linux-ng for full enumeration?

Run enum4linux-ng -A target to perform a comprehensive scan including users, shares, groups, policies, and system information. Use -u user -p pass for authenticated enumeration.

What are the most common enum4linux-ng commands?

Common commands include: enum4linux-ng -A target (full scan), enum4linux-ng target -u user -p pass (authenticated), enum4linux-ng target -oJ output.json (JSON export).

How does enum4linux-ng compare to SMBMap?

enum4linux-ng focuses on SMB enumeration (users, groups, policies). SMBMap focuses on share enumeration and file operations. Use both for comprehensive SMB assessment.

Is enum4linux-ng legal to use?

enum4linux-ng itself is legal software. However, enumerating SMB services without permission from the owner may violate laws. Always obtain written authorization before testing.

What is the -A flag in enum4linux-ng?

The -A flag enables all enumeration options, providing a comprehensive scan including users, shares, groups, policies, and system information in a single command.

How do I export enum4linux-ng results?

Use -oJ for JSON output: enum4linux-ng target -oJ output.json. Use -oA for all output formats. JSON format is useful for automated processing and reporting.

Why is enum4linux-ng not finding users?

The target may restrict user enumeration without valid credentials, or SMB may be disabled. Try with valid domain credentials, or check if the target has SMB ports open (445/139).

What is a null session in SMB?

A null session allows unauthenticated access to SMB services, potentially revealing users, shares, and policies. enum4linux-ng tests for this vulnerability automatically.

How do I enumerate Active Directory with enum4linux-ng?

Use enum4linux-ng with valid domain credentials: enum4linux-ng -u user@domain.com -p pass -A target. This extracts domain users, groups, and AD information.

What output does enum4linux-ng provide?

enum4linux-ng output shows users, groups, shares, policies, OS info, and domain details organized by category. JSON output provides structured data for automation.

How long does an enum4linux-ng scan take?

A basic scan takes 30-60 seconds. Full enumeration (-A) with authentication takes 1-3 minutes depending on the target and network conditions.

What is the difference between enum4linux-ng and rpcclient?

enum4linux-ng automates comprehensive SMB enumeration. rpcclient provides manual RPC queries for specific information. Use enum4linux-ng for automation; rpcclient for targeted queries.

How do I check password policies with enum4linux-ng?

enum4linux-ng automatically extracts password policies during enumeration. The output shows minimum/maximum password age, history, and complexity requirements.

What ports does enum4linux-ng use?

enum4linux-ng uses SMB ports 445 (direct SMB) and 139 (NetBIOS over TCP/IP). Ensure these ports are accessible on the target.

Tags

#smb#enumeration#network#windows

Output Explanation

enum4linux-ng output shows SMB/Samba enumeration results organized by category: user accounts, groups, shares, password policy, OS information, and domain details. Authenticated scans reveal additional data like group memberships and share permissions. JSON output provides structured data for automation.

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.