SMB Share Enumeration: smbclient and enum4linux
Which TWO of the following are valid methods for enumerating SMB shares on a target system? (Select 2)
Quick Answer
The answer is smbclient and enum4linux, as both are standard tools for SMB share enumeration on a target system. smbclient -L //target -U '' works by initiating a null session—an unauthenticated connection that exploits default SMB configurations—to list available shares without credentials, while enum4linux -a target automates a broader sweep, pulling share names, user lists, and OS details from the same protocol. On the Certified Ethical Hacker CEH exam, this question tests your understanding of reconnaissance techniques in the System Hacking phase, where enumerating network resources is a critical step before exploitation. A common trap is confusing smbclient with tools like nmap or NetBIOS scanners, but remember that smbclient directly queries SMB shares, and enum4linux wraps multiple SMB enumeration calls into one command. Memory tip: think “SMB shares need a client to list them and a Linux tool to enumerate them fully”—smbclient for listing, enum4linux for deep dive.
⚠ Common exam trap
Watch out — candidates often confuse NetBIOS enumeration (using `nbtstat`) with SMB share enumeration, or they mistakenly think UDP scans on port 445 (which is TCP-only) are valid for SMB discovery.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
smbclient -L //target -U ''
`smbclient -L //target -U ''` attempts to list SMB shares on the target by connecting with a null session (empty username). This is a classic enumeration technique that exploits default or weak SMB configurations, allowing an attacker to retrieve share names without authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
smbclient -L //target -U ''
Why this is correct
smbclient -L lists available shares.
- ✗
snmpwalk -v2c -c public target
Why it's wrong here
snmpwalk is for SNMP, not SMB.
- ✗
nmap -sU -p 445 target
Why it's wrong here
UDP scan on port 445 is not typical; SMB uses TCP 445. The command does not enumerate shares.
- ✗
nbtstat -A target
Why it's wrong here
nbtstat enumerates NetBIOS names, not SMB shares directly.
- ✓
enum4linux -a target
Why this is correct
enum4linux enumerates SMB information including shares.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO tools can be used to enumerate SMB shares and users on a Windows target? (Choose two.)
easy- ✓ A.smbclient
- ✓ B.enum4linux
- C.nslookup
- D.snmpwalk
- E.ldapsearch
Why A: smbclient is a command-line tool that uses the SMB/CIFS protocol to connect to Windows file shares. It can list available shares with the `-L` option and, with valid credentials, enumerate users via the `-U` flag or by browsing the IPC$ share. enum4linux is a wrapper script that automates the enumeration of information from Windows and Samba hosts, including users, groups, shares, and more, by leveraging tools like smbclient and rpcclient. Both are direct tools for SMB enumeration.
Variation 2. A penetration tester is enumerating services on a target Windows server. Which TWO tools are specifically designed for SMB enumeration? (Select two.)
medium- A.John the Ripper
- B.SNMPwalk
- C.Nmap
- ✓ D.enum4linux
- ✓ E.smbclient
Why D: enum4linux (D) is a Perl script that wraps Samba tools like smbclient, rpcclient, and net to enumerate SMB shares, users, and OS information from Windows systems. smbclient (E) is a native Samba client that allows direct interaction with SMB shares, including listing, connecting, and transferring files. Both are purpose-built for SMB enumeration.
Variation 3. Which TWO of the following are enumeration techniques used to gather information from Windows systems? (Select 2)
medium- ✓ A.SMB enumeration using enum4linux
- B.SMTP enumeration using VRFY
- C.LDAP enumeration using ldapsearch
- D.NFS enumeration using showmount
- ✓ E.NetBIOS enumeration using nbtstat
Why A: SMB enumeration using enum4linux is correct because enum4linux is a tool that queries Windows SMB shares, user lists, and OS information via the SMB protocol (ports 139/445). It leverages SMB null sessions to extract data like user accounts, group memberships, and share permissions, making it a standard enumeration technique for Windows systems. NetBIOS enumeration using nbtstat is also correct as NetBIOS is a legacy but still relevant naming service on Windows networks, and `nbtstat` is a built-in Windows command-line utility used to display NetBIOS over TCP/IP protocol statistics, including remote NetBIOS name tables, which can reveal hostnames, workgroup/domain names, and MAC addresses.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.