enum4linux is a Unix-friendly enumeration utility that extracts information from Windows and Samba hosts over SMB, aiding both penetration testers and defenders. It drives standard tools under the hood to query for user and group lists, share exports, password policy settings, OS details, and RID cycling—often even via null sessions when allowed. Output is organized and grep-able, making it easy to pivot quickly from discovery to targeted probing or remediation. The script includes options to test multiple authentication modes, try name lookups, and probe RPC endpoints to widen the information surface. Because it runs on Linux and macOS, it slots naturally into automated recon workflows and red-team pipelines. Used responsibly, it’s an effective way to uncover misconfigurations and weak access controls before adversaries do.
Features
- Enumerates domain info, users, groups, password policies, and SMB shares
- Uses Samba utilities like smbclient, rpcclient, net, and nmblookup under the hood
- Supports RID cycling and SID-to-user mapping for further enumeration
- Simple, scriptable CLI interface for reconnaissance and auditing
- GPLv2-licensed and widely used in security scanning toolkits (like Kali)
- Bypasses directory listing restrictions while gathering host data
Project Samples
