How do I install the Enum4linux skill?

Run npx skillmds@latest add aeondave/enum4linux in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Enum4linux safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Enum4linux?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Enum4linux free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under GPL-2.

Who published Enum4linux?

AeonDave (@aeondave) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Enum4linux by aeondave — Agent Skill

Name: Enum4linux
Author: AeonDave

File contents

enum4linux

SMB enumeration tool — extracts users, shares, groups, and domain info from Windows/Samba hosts.

Quick Start

# Full enumeration (null session)
enum4linux -a 192.168.1.10

# With credentials
enum4linux -a -u admin -p password 192.168.1.10

# Modern rewrite (enum4linux-ng recommended)
enum4linux-ng -A 192.168.1.10

Flags (Classic)

Flag	Description
`-a`	All: runs `-U -S -G -P -r -o -n -i`
`-U`	User list via RPC
`-M`	Machine list
`-S`	Share enumeration
`-P`	Password policy
`-G`	Group enumeration
`-r`	User list via RID cycling
`-R <range>`	RID range (default `500-550,1000-1050`)
`-u <user>`	Username for auth
`-p <pass>`	Password for auth
`-d`	Debug mode
`-v`	Verbose
`-o`	Get OS information
`-i`	Printer info
`-n`	Nmblookup info

enum4linux-ng Flags (Recommended)

Flag	Description
`-A`	All checks
`-u <user>`	Username
`-p <pass>`	Password
`-oJ <file>`	JSON output
`-oY <file>`	YAML output
`-t <n>`	Timeout
`--no-color`	Disable color output

Common Workflows

# Full null session enum (no creds)
enum4linux -a 10.10.10.100

# Authenticated full enum
enum4linux -a -u "DOMAIN\user" -p "password" 10.10.10.100

# RID cycling for user enumeration
enum4linux -r -R 500-2000 10.10.10.100

# Modern approach with JSON output
enum4linux-ng -A 10.10.10.100 -oJ output.json

# Share enumeration only
enum4linux -S 10.10.10.100

# Password policy extraction
enum4linux -P 10.10.10.100

Key Info Extracted

Domain/workgroup name and OS version
User accounts (via RPC and RID brute-force)
Shares (writable/readable)
Group memberships
Password policy (lockout threshold, complexity)
Printer and session info

Resources

File	When to load
`references/smb-enumeration.md`	SMB enumeration techniques, smbclient commands, null session exploitation

---name: enum4linuxdescription: Auth/lab ref: enum4linux SMB/Samba enumeration; users, shares, groups, OS info, password policy, null-session evidence.license: GPL-2.0---# enum4linuxSMB enumeration tool — extracts users, shares, groups, and domain info from Windows/Samba hosts.## Quick Start```bash# Full enumeration (null session)enum4linux -a 192.168.1.10# With credentialsenum4linux -a -u admin -p password 192.168.1.10# Modern rewrite (enum4linux-ng recommended)enum4linux-ng -A 192.168.1.10```## Flags (Classic)| Flag | Description ||------|-------------|| `-a` | All: runs `-U -S -G -P -r -o -n -i` || `-U` | User list via RPC || `-M` | Machine list || `-S` | Share enumeration || `-P` | Password policy || `-G` | Group enumeration || `-r` | User list via RID cycling || `-R <range>` | RID range (default `500-550,1000-1050`) || `-u <user>` | Username for auth || `-p <pass>` | Password for auth || `-d` | Debug mode || `-v` | Verbose || `-o` | Get OS information || `-i` | Printer info || `-n` | Nmblookup info |## enum4linux-ng Flags (Recommended)| Flag | Description ||------|-------------|| `-A` | All checks || `-u <user>` | Username || `-p <pass>` | Password || `-oJ <file>` | JSON output || `-oY <file>` | YAML output || `-t <n>` | Timeout || `--no-color` | Disable color output |## Common Workflows```bash# Full null session enum (no creds)enum4linux -a 10.10.10.100# Authenticated full enumenum4linux -a -u "DOMAIN\user" -p "password" 10.10.10.100# RID cycling for user enumerationenum4linux -r -R 500-2000 10.10.10.100# Modern approach with JSON outputenum4linux-ng -A 10.10.10.100 -oJ output.json# Share enumeration onlyenum4linux -S 10.10.10.100# Password policy extractionenum4linux -P 10.10.10.100```## Key Info Extracted- Domain/workgroup name and OS version- User accounts (via RPC and RID brute-force)- Shares (writable/readable)- Group memberships- Password policy (lockout threshold, complexity)- Printer and session info## Resources| File | When to load ||------|--------------|| `references/smb-enumeration.md` | SMB enumeration techniques, smbclient commands, null session exploitation |

Frequently asked questions

Enum4linux