# Enum4linux Ng

> Use for SMB and Windows host enumeration during authorized internal assessments. Trigger on Windows file sharing, workgroup or domain discovery, user and share review, and validating internal attack surface assumptions.

- Skill: `timsonner/enum4linux-ng` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/enum4linux-ng`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/enum4linux-ng/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/enum4linux-ng

---


# Enum4linux-ng

## Purpose

Use this skill for SMB-focused enumeration in approved internal Windows environments.

## Phase Fit

- Primary: Discovery and Reconnaissance, Vulnerability Analysis
- Secondary: Retest and Closure

## Use When

- Need to enumerate SMB shares, host identity, and accessible Windows metadata.
- Need to validate exposure assumptions in an internal Windows segment.
- Need a narrower SMB view before deeper auth-boundary testing.

## Avoid When

- SMB targets are out of scope.
- Authentication context is unclear or would cause account lockout risk.

## Inputs

- Approved Windows hosts
- Allowed credential context, if any
- Lockout and monitoring considerations

## Procedure

1. Start unauthenticated if the rules of engagement allow it.
2. Add credentials only when necessary and approved.
3. Review shares, host metadata, and access patterns for material exposure.
4. Correlate findings with asset ownership and privilege assumptions.
5. Preserve the exact host and auth context for retest.

## Command Syntax

Replace sample targets with approved in-scope assets and authorized credentials.

```bash
# Full enumeration (null session)
enum4linux-ng -A 10.10.10.100

# Full enumeration with credentials
enum4linux-ng -A -u 'contoso\auditor' -p '<password>' 10.10.10.100

# Enumerate users only
enum4linux-ng -U 10.10.10.100

# Enumerate shares only
enum4linux-ng -S 10.10.10.100

# Output to YAML and JSON
enum4linux-ng -A -oY contoso-enum4linux.yml -oJ contoso-enum4linux.json 10.10.10.100
```

## Evidence to Capture

- Accessible shares and Windows host metadata
- Differences between unauthenticated and authenticated exposure
- Assets requiring deeper SMB or identity review

## Safety Boundaries

- Respect lockout and monitoring thresholds.
- Do not broaden credential use beyond the approved host set.