enum4linux
enumerate information from Windows and Samba systems
TLDR
Enumerate using all methods
$ enum4linux -a [remote_host]
Enumerate using given credentials$ enum4linux -u [user_name] -p [password] [remote_host]
List usernames from a host$ enum4linux -U [remote_host]
List shares$ enum4linux -S [remote_host]
Get OS information$ enum4linux -o [remote_host]
SYNOPSIS
enum4linux [options] target
DESCRIPTION
enum4linux enumerates information from Windows and Samba systems using SMB. It extracts user lists, share information, group membership, password policies, and operating system details.A Perl wrapper around tools like smbclient, rpcclient, and nmblookup for penetration testing.
PARAMETERS
-a
Do all simple enumeration-U
Get user list-S
Get share list-o
Get OS information-u user
Username for authentication-p password
Password for authentication-G
Get group information-P
Get password policy-r
Enumerate users via RID cycling (works even when RestrictAnonymous blocks direct listing)-M
Get machine list-d
Be detailed, applies to -U and -S-w workgroup
Specify the workgroup or domain manually
INSTALL
nix profile install nixpkgs#enum4linux
CAVEATS
Security testing tool. Use only on systems you have permission to test. Some enumeration requires valid credentials or a null session, which modern Windows blocks by default. May trigger security alerts. The original Perl enum4linux is effectively unmaintained; enum4linux-ng, a Python rewrite, is the actively developed successor and produces cleaner, machine-readable output.