enum4linux-ng — Install, Use, Optimise (2026)

Modernized SMB enumeration — users, shares, password policy, RID cycling, sessions. The Python rewrite of the classic enum4linux.

Installation

Pick the install method that matches your stack. The Docker option is the cleanest for one-off scans where you don’t want to pollute your workstation.

pipx

pipx install enum4linux-ng

Linux (apt)

sudo apt install enum4linux-ng

Core commands

The handful of invocations you’ll actually run on 90% of engagements:

Default enum

enum4linux-ng -A 10.0.0.5

With creds

enum4linux-ng -u admin -p pass -A 10.0.0.5

Just shares

enum4linux-ng -S 10.0.0.5

Just user enum (RID cycling)

enum4linux-ng -R 10.0.0.5

JSON output

enum4linux-ng -A -oJ result.json 10.0.0.5

Performance optimisation

What separates a junior who runs the default invocation from a practitioner who knows the knobs:

• Single-host tool — for subnet sweep, wrap in xargs or use NetExec instead.
• -A all checks — combines RPC, SMB, LDAP, sessions. Default and recommended.
• -T timeout per check — useful for fragile servers.

Common pitfalls

Real failure modes that bite people on engagements. Most are recoverable; a few are reputation-damaging.

• Older versions had Python2 dependency — ensure you’re on enum4linux-NG (Python3) not the original.
• Modern Windows defaults block null sessions — many checks return empty without creds.
• Loud — generates many SMB connections. Detected by SOC tools that monitor SMB volume.

Modern alternatives in 2026

The ecosystem moves fast. These are tools you should at least be aware of:

• NetExec smb — bulk-friendly version of similar checks.
• smbmap — share-focused alternative.

India context and engagement notes

First-day internal pen-test recipe: enum4linux-ng -A $TARGET on each Windows server in scope. Surprisingly often reveals null-session-readable shares on legacy Windows 2008 R2 / 2012 servers still common in Indian enterprises.

⚖️ Legal: Use only on systems you own or have explicit written authorisation to test. In India, unauthorised access is punishable under Section 66 of the IT Act, 2000 (up to 3 years imprisonment + fine). Pair every engagement with a signed Statement of Work or Rules of Engagement before running anything from this page.