timsonner Enum4linux-ng
Purpose
Use this skill for SMB-focused enumeration in approved internal Windows environments.
Phase Fit
- Primary: Discovery and Reconnaissance, Vulnerability Analysis
- Secondary: Retest and Closure
Use When
- Need to enumerate SMB shares, host identity, and accessible Windows metadata.
- Need to validate exposure assumptions in an internal Windows segment.
- Need a narrower SMB view before deeper auth-boundary testing.
Avoid When
- SMB targets are out of scope.
- Authentication context is unclear or would cause account lockout risk.
Inputs
- Approved Windows hosts
- Allowed credential context, if any
- Lockout and monitoring considerations
Procedure
- Start unauthenticated if the rules of engagement allow it.
- Add credentials only when necessary and approved.
- Review shares, host metadata, and access patterns for material exposure.
- Correlate findings with asset ownership and privilege assumptions.
- Preserve the exact host and auth context for retest.
Command Syntax
Replace sample targets with approved in-scope assets and authorized credentials.
# Full enumeration (null session)
enum4linux-ng -A 10.10.10.100
# Full enumeration with credentials
enum4linux-ng -A -u 'contoso\auditor' -p '<password>' 10.10.10.100
# Enumerate users only
enum4linux-ng -U 10.10.10.100
# Enumerate shares only
enum4linux-ng -S 10.10.10.100
# Output to YAML and JSON
enum4linux-ng -A -oY contoso-enum4linux.yml -oJ contoso-enum4linux.json 10.10.10.100
Evidence to Capture
- Accessible shares and Windows host metadata
- Differences between unauthenticated and authenticated exposure
- Assets requiring deeper SMB or identity review
Safety Boundaries
- Respect lockout and monitoring thresholds.
- Do not broaden credential use beyond the approved host set.