PAGES
← all tools
◆ Reconnaissance & OSINT

enum4linux-ng

v1.3.5 open-source

enum4linux-ng is a rewrite of enum4linux for enumerating information from Windows and Samba systems, wrapping nmblookup, net, rpcclient, and smbclient.

source ↗ rss ↗ What is a cyber toolchain?

Summary

enum4linux-ng is an open-source, GPLv3-licensed command-line tool that enumerates information from Windows and Samba systems, wrapping the Samba utilities nmblookup, net, rpcclient and smbclient into a single scan. It is a rewrite of the older enum4linux.pl, aimed at security professionals and CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. players who need SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments., LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. and Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. recon rather than exploitation. It supports multiple authentication methods including KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. and pass-the-hash, parses all tool output into YAML or JSON for feeding into other pipelines, and can run directly or via a Docker container. First committed in 2020 and maintained by 16 contributors, it remains active with 17 commits in the past year, though its most recent release was about six months ago.

enum4linux-ng is a rewrite of enum4linux for enumerating information from Windows and Samba systems, wrapping nmblookup, net, rpcclient, and smbclient.

How enum4linux-ng helps

What accounts, groups and roles exist on this Windows or Samba host?

queries the target over SMB and RPC to list users, groups and group memberships directly from the machine, rather than relying on a directory dump someone hands you

What shares can be reached on this server, and by whom?

lists the available shares and checks the access each supplied credential actually has against them

Is this domain controller or member server exposed to a null or guest session it shouldn't be?

tries unauthenticated and guest logons against the target and reports what information they still manage to pull back

How weak are the password rules an attacker would face on this box?

retrieves the account and password policy, including lockout thresholds and how old the current policy is, so you can judge if it would survive a guessing attempt

Which of my hosts still accept legacy SMB connections or unsigned sessions?

negotiates the SMB dialects and signing support offered by the target and flags where older, less secure options are still accepted

Could a leaked password hash or Kerberos ticket get someone into this system without the plaintext?

authenticates using a supplied hash or Kerberos ticket and reports whether the target accepts it, surfacing the same access a stolen credential would grant

all 5 features, with the evidence for each →

Languages

Not documented

Features

5 capabilities · 1 backed by code, an API document or a real run

Built from enum4linux-ng's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

  • enum4linux-ng covers 1 of the 13 network discovery and scanning capabilities we track.

What enum4linux-ng offers you

  • Command-line interface1
All capabilities 5 capabilities
Authentication methods verified Supports authenticating to targets using a password hash, Kerberos (for Active Directory environments), or local authentication. 5 other sources · first seen Dec 2022

Also counts toward: Command-line interface

docs

  • Enumerates information from Windows and Samba systems by wrapping nmblookup, net, rpcclient, and smbclient with YAML/JSON export support.

command line

  • -H — Try to authenticate with hash v1.2.0 · Dec 2022 · command-line history
  • -K — Try to authenticate with Kerberos, only useful in Active Directory environment v1.2.0 · Dec 2022 · command-line history
  • --local-auth — Authenticate locally to target v1.2.0 · Dec 2022 · command-line history

example

  • Enumerate with credentials, save YAML output enum4linux-ng.py 192.168.125.131 -u Tester -p 'Start123!' -oY out
Output formatting shipped Enhances session outputs with additional detail and adds year values to password policy output for clearer age-based review. 2 releases · first seen Aug 2025

release

  • Enhances sessions output with additional detail. v1.3.5 · Aug 2025 · source · release history
  • Adds year values to password policy output for clearer age-based policy review. v1.3.5 · Aug 2025 · source · release history
Deployment options shipped Allows the tool to be run via Docker container or Python virtual environment. 2 other sources

example

  • Run tool via Docker container docker run -t enum4linux-ng -As <target>
  • Run via Python virtual environment python3 enum4linux-ng.py -As <target>
Enhanced authentication validation shipped Performs Kerberos ticket permission checks and provides guidance on DNS configuration requirements for successful authentication. 1 release · first seen Aug 2025

release

  • Adds Kerberos ticket permission checks and informs users when DNS must be configured correctly for Kerberos authentication. v1.3.5 · Aug 2025 · source · release history
SMB protocol support shipped Supports enumerating modern Windows servers using the SMB 3.1.1 protocol. 1 release · first seen Dec 2022

Shared capability: Attack surface inventory

release

  • Adds SMB 3.1.1 protocol support for enumerating modern Windows servers v1.2.0 · Dec 2022 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for enum4linux-ng, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail enum4linux-ng puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

2 entries

  1. August 20251
  3. December 20221

    2 entries

    1. v1.3.5 Aug 5, 2025 · release notes

      enum4linux-ng v1.3.5 adds year display to password policy, enhanced session output, and KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. DNS guidance.

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.3.5 https://github.com/cddmp/enum4linux-ng.git
# already have the repo? check out this version:
$ git checkout v1.3.5
      • Adds year values to password policy output for clearer age-based policy review.
      • Enhances sessions output with additional detail.
      • Adds Kerberos ticket permission checks and informs users when DNS must be configured correctly for Kerberos authentication.

      3 details in Everything

    2. v1.2.0 Dec 13, 2022 · release notes

      enum4linux-ng v1.2.0 adds SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. 3.1.1 support and new auth methods

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.2.0 https://github.com/cddmp/enum4linux-ng.git
# already have the repo? check out this version:
$ git checkout v1.2.0
      • Adds SMB 3.1.1 protocol support for enumerating modern Windows servers
      • Adds additional authentication methods (e.g., NTLMv2NTLMv2A Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent., KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application.) to bypass older auth restrictions

      2 details in Everything

    Project health

    Issue, contributor and maintainer activity in cddmp/enum4linux-ng, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 1 −3 vs prior 12 months
    2. Maintainers 1 +0 joined · −0 left, last 12 months
    3. Bus factor 1 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close 50 days first maintainer reply 2.9 hours
    6. Open backlog 1 of 32 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 1
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 1,657
    Issue themes, last 12 months
    • features 67%
    • questions 33%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback