Project 59: Enum4linux Defensive Audit

Module: Module 6: Applied Web Security & Defensive Automation  |  Level: Intermediate  | 
Primary tool: enum4linux-ng (free, open-source)  |  Estimated time: 75–120 minutes

Objective: Enumerate SMB/AD misconfigurations the way an attacker would, to close them first.

Free lab environment

GOAD — Game of Active Directory (free, self-deployed) — https://github.com/Orange-Cyberdefense/GOAD

GOAD is a free, open-source, fully scripted vulnerable Active Directory lab you deploy yourself in Vagrant/VirtualBox — the standard free option for practicing AD security concepts legally in an isolated environment. A lighter free alternative is TryHackMe’s ‘Attacktive Directory’ room.

Lab workflow

1. Deploy Metasploitable2 or a GOAD lab deployment inside an isolated lab network — never point AD/SMB enumeration tools at a production or shared network.
2. Using enum4linux-ng (free, open-source), enumerate what is reachable, with the specific goal of enumerate SMB/AD misconfigurations the way an attacker would, to close them first.
3. For each item enumerated without authentication, ask: should this really be reachable anonymously?
4. Identify the single most sensitive item exposed and write its specific remediation (a config change, not a vague ‘restrict access’).
5. If possible, apply that fix in your lab and re-run the enumeration to confirm the exposure is gone.
6. Summarize your findings as if briefing a system administrator who needs to act on them today.

Evidence & screenshot requirements

Submit the following with your report (see this module’s practical assignment for exact upload details):

• enum4linux-ng output listing shares/users it could enumerate anonymously
• your written remediation for the single most sensitive item it exposed

Expected deliverable

A concise lab-report entry containing: scope/target, exact commands or payloads used, your key
observation, the required screenshots above, and — where applicable — the specific remediation for what
you found. Vague answers (“sanitize input”, “use a firewall”) without naming the exact mechanism will not
receive full credit.

Safety & authorization

Only test the specific free lab target named above, or infrastructure you personally own. Do not target
third-party systems, real user accounts, or production services without explicit written authorization.
Never deploy anything from this project outside an isolated lab environment.