> For the complete documentation index, see [llms.txt](https://alirodoplu.gitbook.io/ali-rodoplu/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alirodoplu.gitbook.io/ali-rodoplu/offensive/enum4linux.md).
# Enum4Linux
{% hint style="warning" %}
Use what I'm about to say in this article only for the right purposes, such as raising security awareness and improving the security posture of your environments. I do not accept any responsibility for other uses.
{% endhint %}
Enum4Linux is a tool used to collect information from Windows and Samba systems. Some information that Enum4Linux can collect;
->Shared files and directories of the target system, \
->Working users and groups of the target system, \
->NetBIOS name and IP address of the target system, \
->Operating system version of the target system, \
->Security settings of the target system.
Enum4linux is a tool written in Perl language used in collecting information in penetration tests. So let's talk about how we can use it.
### Requirements
-> Kali Linux\
->Metasploitable
First of all, deploy ***Metasploitable***, a vulnerable Linux variant, to your environment. Metasploitable's default username and password is "***msfadmin***". Log in with this information.
Metasploitable Terminal
Metasploitable does not have a graphical interface by default and I used Metasploitable in one of my previous articles, "[***Exploiting the Shellshock Vulnerability and Protecting Yourself against It***](/ali-rodoplu/offensive/exploiting-the-shellshock-vulnerability-and-protecting-yourself-against-it.md)", where I explained another vulnerability, the Shellshock vulnerability.
Let's see which ports are open by starting an nmap scan from our Attacker machine.
```bash
nmap -Pn
```
As we see, our SMB ports are open on the target machine. This means that we can continue to look for vulnerabilities in these ports with enum4linux.
The ***-U*** parameter is used to list the users on the target.
```bash
enum4linux -U
```
Kali Terminal
We can see the status of shared environments by using the ***-S*** parameter.
```bash
enum4linux -S
```
Kali Terminal
As you can see, we understand that we have access to the ***\/tmp*** directory and have permission to list it.
We can see the status of password policy informations by using the ***-P*** parameter.
```bash
enum4linux -P
```
Kali Terminal
We can check the status of NetBIOS services using the ***-n*** parameter.
```bash
enum4linux -n
```
Kali Terminal
We can check the all SIDs using the ***-r*** parameter.
```bash
enum4linux -r
```
Kali Terminal
### **What needs to be done to avoid such scanning and information acquisition attacks;**
->Turn off unused services,\
->Staying away from vulnerable protocols,\
->Use strong passwords,\
->Delete unnecessary users from the system,
### **Resources Used**
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://alirodoplu.gitbook.io/ali-rodoplu/offensive/enum4linux.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
