The Lightweight Directory Access Protocol is an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services.
Active Directory information dumper via LDAP
link: https://github.com/dirkjanm/ldapdomaindump
enumerating using username and password:
root@kali# ldapdomaindump -u 'htb.local\\amanda' -p Ashare1972 10.10.10.103 -o ~/hackthebox/sizzle-10.10.10.103/ldap/
[*] Connecting to host...
[*] Binding to host
[+] Bind OK
[*] Starting domain dump
[+] Domain dump finished
root@kali# ls ~/hackthebox/sizzle-10.10.10.103/ldap/
domain_computers_by_os.html domain_computers.json domain_groups.json domain_policy.json domain_trusts.json domain_users.html
domain_computers.grep domain_groups.grep domain_policy.grep domain_trusts.grep domain_users_by_group.html domain_users.json
domain_computers.html domain_groups.html domain_policy.html domain_trusts.html domain_users.grep
nmap --script ldap-* 10.10.10.169
Anonymous Credential LDAP Dumping:
ldapsearch -LLL -x -H ldap://10.10.10.175 -b ‘’ -s base ‘(objectclass=*)’
-x - simple auth-h 10.10.10.175 - host to query-s base - set the scope to base*in later version they replace the -h into -H ldap://
Find domain name using base naming contexts:
ldapsearch -h 10.10.10.192 -x -s base namingcontexts
Find information using domain name: