SMB Share Enumeration: smbclient and enum4linux
Which TWO of the following are valid methods for enumerating SMB shares on a target system? (Select 2)
Quick Answer
The answer is smbclient and enum4linux, as both are standard tools for SMB share enumeration on a target system. smbclient -L //target -U '' works by initiating a null session—an unauthenticated connection that exploits default SMB configurations—to list available shares without credentials, while enum4linux -a target automates a broader sweep, pulling share names, user lists, and OS details from the same protocol. On the Certified Ethical Hacker CEH exam, this question tests your understanding of reconnaissance techniques in the System Hacking phase, where enumerating network resources is a critical step before exploitation. A common trap is confusing smbclient with tools like nmap or NetBIOS scanners, but remember that smbclient directly queries SMB shares, and enum4linux wraps multiple SMB enumeration calls into one command. Memory tip: think “SMB shares need a client to list them and a Linux tool to enumerate them fully”—smbclient for listing, enum4linux for deep dive.
⚠ Common exam trap
Watch out — candidates often confuse NetBIOS enumeration (using `nbtstat`) with SMB share enumeration, or they mistakenly think UDP scans on port 445 (which is TCP-only) are valid for SMB discovery.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
smbclient -L //target -U ''
`smbclient -L //target -U ''` attempts to list SMB shares on the target by connecting with a null session (empty username). This is a classic enumeration technique that exploits default or weak SMB configurations, allowing an attacker to retrieve share names without authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
smbclient -L //target -U ''
Why this is correct
smbclient -L lists available shares.
- ✗
snmpwalk -v2c -c public target
Why it's wrong here
snmpwalk is for SNMP, not SMB.
- ✗
nmap -sU -p 445 target
Why it's wrong here
UDP scan on port 445 is not typical; SMB uses TCP 445. The command does not enumerate shares.
- ✗
nbtstat -A target
Why it's wrong here
nbtstat enumerates NetBIOS names, not SMB shares directly.
- ✓
enum4linux -a target
Why this is correct
enum4linux enumerates SMB information including shares.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 913 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO tools can be used to enumerate SMB shares and users on a Windows target? (Choose two.)
easy- ✓ A.smbclient
- ✓ B.enum4linux
- C.nslookup
- D.snmpwalk
- E.ldapsearch
Why A: smbclient (A) is correct because its -L and -N options let you list SMB shares and, with -U, authenticate to enumerate shares and users on a Windows host over TCP 445/139. enum4linux (B) is correct because it wraps smbclient, rpcclient, and nmblookup to pull share lists, user lists, and group/password-policy data from SMB/RPC on Windows targets. nslookup (C) is wrong because it only queries DNS records and cannot touch SMB. snmpwalk (D) is wrong because it walks SNMP OIDs (UDP 161) and does not enumerate SMB shares or users. ldapsearch (E) is wrong because it queries LDAP directories (TCP 389/636) rather than SMB/RPC services.
Variation 2. A penetration tester is enumerating services on a target Windows server. Which TWO tools are specifically designed for SMB enumeration? (Select two.)
medium- A.John the Ripper
- B.SNMPwalk
- C.Nmap
- ✓ D.enum4linux
- ✓ E.smbclient
Why D: enum4linux (D) is a Perl script that wraps Samba tools like smbclient, rpcclient, and net to enumerate SMB shares, users, and OS information from Windows systems. smbclient (E) is a native Samba client that allows direct interaction with SMB shares, including listing, connecting, and transferring files. Both are purpose-built for SMB enumeration.
Variation 3. Which TWO of the following are enumeration techniques used to gather information from Windows systems? (Select 2)
medium- ✓ A.SMB enumeration using enum4linux
- B.SMTP enumeration using VRFY
- C.LDAP enumeration using ldapsearch
- D.NFS enumeration using showmount
- ✓ E.NetBIOS enumeration using nbtstat
Why A: Option A is correct because enum4linux is a Linux-based tool that queries SMB/NetBIOS services on Windows hosts to extract users, shares, groups, and password policy information, making it a classic Windows enumeration technique. Option E is correct because nbtstat is a native Windows command-line utility that queries NetBIOS name tables and cached names over UDP ports 137/138, revealing hostnames, domain names, and logged-on user information from Windows systems. Option B is not correct because SMTP VRFY enumeration targets mail servers to validate email addresses, not Windows system information. Option C is not correct because ldapsearch queries LDAP directory services (such as Active Directory) rather than enumerating the Windows host itself. Option D is not correct because showmount enumerates NFS exports, which is a Unix/Linux file-sharing service, not a Windows enumeration technique.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.