root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to cheatsheets
root@sparrow:~/writeups$ cat enum4linux.md
// Active Directory

enum4linux

21 Jul 2026 · 5 min read
Active Directorycheatsheetsenum4linux
Enum4linux is a Perl wrapper around the Samba tools (smbclient, rpcclient, net, nmblookup) that automates the enumeration of Windows and Samba systems over SMB/NetBIOS. With a single command it pulls users, groups, shares, password policy and operating system information. It is one of the first stops when auditing an Active Directory environment.

Much of what Enum4linux reveals hinges on the null session: an SMB connection with no username or password that, on old or misconfigured systems, exposes RIDs, users and policy. When null sessions are locked down, RID cycling can still infer accounts by iterating over SIDs; that is why enum4linux-ng leans so heavily on that technique and on telling apart what fails due to permissions versus server configuration.

1. Beginner level — basic SMB enumeration

ENUM4LINUX cheat sheet — Beginner
CommandWhat it does
enum4linux -a <t>Full default enumeration
enum4linux -U <t>Enumerates domain/host users
enum4linux -S <t>Enumerates shared resources (shares)
enum4linux -G <t>Enumerates domain groups
enum4linux -P <t>Enumerates the password policy
enum4linux -O <t>Enumerates operating system information
enum4linux -M <t>Enumerates machine group memberships
enum4linux -N <t>Enumerates via null session
enum4linux -I <t>Enumerates the domain SID
enum4linux -R <t>Enumerates user and group RIDs
enum4linux -u user -p pass <t>Authenticates with known credentials
enum4linux -a <t> > out.txtSaves all output to a file
enum4linux -v <t>Verbose mode
enum4linux -hShows the help with all options

2. Advanced level — enum4linux-ng and RPC/SMB

ENUM4LINUX cheat sheet — Advanced
CommandWhat it does
enum4linux-ng -A <t>Full enumeration with the NG version
enum4linux-ng -A <t> -oJ out.jsonExports the results in JSON format
enum4linux-ng -A <t> -oY out.yamlExports the results in YAML format
enum4linux-ng -C <t>Checks only the null session status
enum4linux-ng -R <t>Forces RID bruteforcing
enum4linux-ng -r <rango> <t>Sets the RID range to test
enum4linux-ng -u user -p pass <t>Authenticates with known credentials
enum4linux-ng -K <t>Enumerates via Kerberos instead of NTLM
enum4linux-ng --shares <t>Enumerates and checks access to shares
enum4linux -a -M <t>Combines full enumeration with memberships
rpcclient -U "" -N <t>Manual null session via rpcclient
smbclient -L //<t>/ -NLists SMB shares without authentication
enum4linux-ng -A <t> --timeout 10Adjusts the request timeout
enum4linux-ng -v -A <t>Verbose mode with full enumeration

3. Details people miss

  • The classic enum4linux is unmaintained and many of its calls fail on modern systems; for current targets use enum4linux-ng, the Python rewrite.
  • You do not need root to run it, but the Samba tools (smbclient, rpcclient) must be installed: the wrapper only orchestrates them, it does not replace them.
  • The null session has been disabled by default on Windows for years; if -N returns nothing it is not a tool failure, the server simply does not allow it. Try with credentials (-u/-p) if you have them.
  • Enum4linux is noisy: -a fires dozens of queries and gets logged on the server. On a red team, tune the options (-U, -S, -P) instead of launching the full enumeration.
  • RID cycling (-R) can be slow against large ranges; in enum4linux-ng narrow the range with -r so the scan does not drag on needlessly.

Responsible use

These commands are for systems you own or have explicit written authorisation to test (labs, CTFs, contracted engagements). Using them against third-party infrastructure without permission is illegal in most countries.