tools

Overview

enum4linux-ng is a rewrite of the original enum4linux tool for enumerating information from Windows and Samba systems over SMB and LDAP. It automates queries that would otherwise require manual use of rpcclient, nmblookup, net, smbclient, and ldapsearch — covering shares, users, groups, OS info, password policies, and more. The -ng version adds JSON/YAML output, LDAP support, and better error handling.

Target / Context

Windows and Samba SMB servers. Most effective against targets allowing null sessions or with known credentials.

Installation

ℹ︎Installation Commands: 
git clone https://github.com/cddmp/enum4linux-ng.git
cd enum4linux-ng
pip3 install -r requirements.txt

Basic Usage

ℹ︎Basic Usage:

Full enumeration (all checks):

./enum4linux-ng.py <target> -A

Authenticated:

./enum4linux-ng.py <target> -A -u username -p password

Flags & Options

ℹ︎Flags & Options:
FlagDescriptionExample
-ARun all enumeration checks./enum4linux-ng.py <IP> -A
-uUsername-u administrator
-pPassword-p P@ssw0rd
-dEnable LDAP enumeration (requires domain)-d
-kKerberos auth (requires domain)-k
-oJOutput results as JSON-oJ results.json
-oYOutput results as YAML-oY results.yaml
-vVerbose output-v
-REnumerate users via RID cycling-R

Common Use Cases

Full Null Session Enumeration

ℹ︎Commands: 
./enum4linux-ng.py 10.129.14.128 -A

Authenticated Full Enumeration

ℹ︎Commands: 
./enum4linux-ng.py 10.129.14.128 -A -u administrator -p "P@ssw0rd"

Save Output as JSON for Parsing

ℹ︎Commands: 
./enum4linux-ng.py 10.129.14.128 -A -oJ results.json
cat results.json | jq .
ℹ︎Note

enum4linux-ng automates many queries but not all. Always follow up with manual rpcclient and smbclient queries — different tools expose different data. Never rely solely on automated enumeration for complete results.

  • Service Enumeration

References / Images