In the Open
In the Open

LDAP

Get Domain

ldapsearch -H ldap://$TARGET_IP -x -s base namingcontexts
  • Use found namingcontexts DC
ldapsearch -H ldap://$TARGET_IP -x -b 'DC=<DC>,DC=<ORG>
  • Authenticated LDAP Search
ldapsearch -H ldap://$TARGET_IP -x -b 'DC=<DC>,DC=<ORG>' -D '<DC>\<user>' -W > outfile

Domain Dump

  • If a set of credentials are known via
ldapdomaindump $TARGET_IP  -u '<domain>\<user>' -p '<password>' --no-json --no-grep
  • Take a look at the genreated HTML files