Pentest Tips
  • ABOUT
  • Information Shares
  • CTF
    • Stego
    • Memory
  • Blue Team
    • Tools/Resources
    • One Liners
    • Threat Hunting
    • Scripts
    • Intrusion
  • Web
    • Resources
    • General Web
    • Subdomain Discovery
    • Content Discovery
    • MYSQL
    • Burpsuite
  • Network Exploitation
    • Resources
    • Kerberos
    • Network Based
    • Phishing
    • Metasploit
    • Weaponization
    • Password Cracking
    • Shell Upgrades
    • Linux PrivEsc
    • Windows PrivEsc
    • Windows Persistence
    • Exfiltration
  • Windows Internals
    • Kernal
  • Recon
    • Nmap
    • OSINT
    • SMB Enumeration
    • LDAP
    • Physical
  • Malware
    • Obfuscation
  • Scripting
    • Bash Basics
    • Powershell Basics
  • Cloud
    • AWS
  • Game Hacking
    • Resources
Powered by GitBook
On this page
  • Good Enumeration Tools
  • LDAPSearch
Edit on GitHub
  1. Recon

LDAP

PreviousSMB EnumerationNextPhysical

Last updated 2 years ago

Good Enumeration Tools

  • LDAPSearch

  • Enum4linux

  • smbclient.py

LDAPSearch

Good Resource:

Basic User Search:

ldapsearch -LLL -H ldap://<domain>.<tld> -D "<user>@<domain>" -w "<password>" -S sub -b "DC=<domain>,DC=<tld>" "(&(objectClass=user))" sAMAccountName | grep -i samaccountname

Other possible Object Classes:

  • groupPolicyContainer

  • Group

Domain Admin Matching Rule And Chain:

ldapsearch -LLL -H ldap://<domain>.<tld> -D "<user>@<domain>" -w "<password>" -S sub -b "DC=<domain>,DC=<tld>" "(&(objectClass=user)(memberof:1.2.840.113556.1.4.1941:=CN=Domain Admins, CN=users,DC=<domain>,DC=<tld>))" sAMAccountName | grep -i samaccountname
https://podalirius.net/en/articles/useful-ldap-queries-for-windows-active-directory-pentesting/