Enum4linux-ng SMB Enumeration

Next generation enum4linux for SMB enumeration

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool: enum4linux-ng
Category: Enumeration / SMB
Platform: linux
Requires: password
Protocols: SMB, RPC

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

enum4linux-ng -A '<ip>' -u '<user>' -p '<password>' -oJ enum4linux_<ip>

Credential variants

The same attack using a different authentication material.

Null Session requires no credentials

enum4linux-ng -A '<ip>' -oJ enum4linux_<ip>

Examples

enum4linux-ng -A '192.168.1.100' -u 'guest' -p '' -oJ enum4linux_192.168.1.100

Tags

enum4linux smb enumeration shares users

Impacket lookupsid Brute-force the RID space against SAMR / LSARPC to enumerate domain users, groups, and…
Impacket NetView Enumerate logged-on users and sessions on remote hosts
Impacket SAMRDump Dump user accounts and group information via SAMR protocol
Impacket SMBClient Interactive SMB client written in pure Python. Drops you into a shell with shares, ls,…
NetExec enum_ca Module Discover Active Directory Certificate Services CA hosts on the network and grab basic CA…
NetExec MS17-010 Check (EternalBlue) Detect MS17-010 (EternalBlue) vulnerable hosts via the SMBv1 transaction probe. Safe…
NetExec Password Policy Enumerate Domain Password Policy
NetExec SMB Enumerate AV Enumerate installed antivirus and security products on remote hosts