CEH Vulnerability Analysis and System Hacking Practice Question
A penetration tester discovers that a target Windows system has port 445 open and responds to SMB requests. Which tool should the tester use to enumerate users, shares, and OS information from this system?
⚠ Common exam trap
Candidates often choose Nmap because it is a versatile tool that can perform SMB enumeration with scripts, but the CEH exam expects the specialized tool (enum4linux) for this specific task, as Nmap is primarily a port scanner and not the dedicated enumeration tool.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
enum4linux
enum4linux is a tool specifically designed to enumerate information from Windows and Samba systems via SMB. It leverages the SMB protocol to extract users, shares, OS details, and other system information from a target with port 445 open, making it the correct choice for this scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Nikto
Why it's wrong here
Nikto is a specialized web server scanner designed to identify common vulnerabilities, misconfigurations, and outdated software on HTTP/HTTPS services. It operates at the application layer (Layer 7) to analyze web applications and servers for known issues. Consequently, Nikto is entirely unsuitable for enumerating information from Windows SMB services, which utilize different network protocols and ports (e.g., 445, 139) and are not web-based.
- ✗
Hydra
Why it's wrong here
Hydra is a robust, multi-protocol brute-forcing tool primarily used for guessing login credentials across a wide array of network services, including SMB. While it can interact with SMB to attempt authentication, its core function is to test for weak passwords, not to passively enumerate system details like user lists, share names, or operating system versions without attempting to log in. Therefore, it is not an enumeration tool in the context of gathering unauthenticated system information.
- ✗
Nmap
Why it's wrong here
Nmap is a versatile network scanner excellent for host discovery, port scanning, service identification, and operating system detection. While Nmap can identify open SMB ports and even use specific NSE scripts (e.g., `smb-os-discovery`) to gather basic SMB-related information, it does not provide the comprehensive, detailed enumeration of users, groups, shares, and system policies that dedicated SMB enumeration tools offer. Its primary role is broader network reconnaissance, not deep SMB-specific data extraction.
- ✓
enum4linux
Why this is correct
enum4linux is a dedicated command-line tool specifically designed for enumerating information from Windows and Samba hosts using NetBIOS and SMB protocols. It effectively leverages null sessions and other SMB/RPC queries to extract a wealth of data, including user lists, group memberships, share names, OS version, service pack level, and even password policies. This makes it an ideal choice for detailed reconnaissance against Windows systems to uncover potential vulnerabilities and gather intelligence.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.