CEH Enumeration and System Hacking Practice Question
Which of the following tools is specifically designed to enumerate SMB shares and user information from Windows systems using the SMB protocol?
⚠ Common exam trap
Watch out — candidates often confuse nmap's broad scanning capabilities (including SMB scripts) with a tool that is purpose-built for SMB enumeration, leading them to select nmap instead of enum4linux.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
enum4linux
enum4linux is a tool specifically designed to enumerate SMB shares, user lists, OS information, and other details from Windows systems by leveraging the SMB protocol (typically over TCP/445 or TCP/139). It automates queries using SMB RPC calls, such as those from the `samr` and `lsarpc` pipes, making it the correct choice for targeted SMB enumeration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
snmpwalk
Why it's wrong here
snmpwalk is a command-line tool used to query devices that support the Simple Network Management Protocol (SNMP). It systematically retrieves all or part of an SNMP Management Information Base (MIB) tree from a target device, providing details about network devices, services, and configurations. While crucial for network device reconnaissance, it operates exclusively on SNMP and has no functionality for enumerating Server Message Block (SMB) shares or users.
- ✗
nmap
Why it's wrong here
Nmap (Network Mapper) is a powerful open-source utility for network discovery and security auditing, primarily used for port scanning, service version detection, and OS fingerprinting. While Nmap can identify open SMB ports (like 445/TCP or 139/TCP) and even run NSE scripts for basic SMB information, it is a general-purpose scanner. It lacks the integrated, comprehensive enumeration capabilities of tools specifically designed to extract detailed SMB share, user, group, and domain information.
- ✓
enum4linux
Why this is correct
enum4linux is a highly effective tool specifically designed for enumerating information from Windows and Samba hosts. It acts as a wrapper script, consolidating the functionality of various underlying utilities such as smbclient, rpcclient, and net to extract a wide array of details. This includes user lists, group memberships, share names, password policies, and even operating system information, making it an indispensable resource for comprehensive Server Message Block (SMB) enumeration during penetration tests.
- ✗
hping3
Why it's wrong here
hping3 is an advanced command-line tool primarily used for crafting and sending custom TCP/IP packets. Its capabilities include firewall testing, port scanning, network testing, and even denial-of-service attacks by manipulating packet headers and payloads. However, hping3 operates at a much lower network layer, focusing on packet manipulation rather than application-layer protocol interaction, and therefore possesses no inherent functionality for enumerating Server Message Block (SMB) resources.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.