2022-11-13 01:16:26 +01:00
|
|
|
# LDAP
|
|
|
|
|
|
|
|
|
|
## Get Domain
|
|
|
|
|
|
2023-08-09 21:50:10 +02:00
|
|
|
Use the `ldapsearch` tool to receive information from an LDAP server.
|
2022-11-13 01:16:26 +01:00
|
|
|
```sh
|
|
|
|
|
ldapsearch -H ldap://$TARGET_IP -x -s base namingcontexts
|
|
|
|
|
```
|
|
|
|
|
* Use found namingcontexts DC
|
|
|
|
|
```sh
|
|
|
|
|
ldapsearch -H ldap://$TARGET_IP -x -b 'DC=<DC>,DC=<ORG>
|
|
|
|
|
```
|
|
|
|
|
* Authenticated LDAP Search
|
|
|
|
|
```sh
|
|
|
|
|
ldapsearch -H ldap://$TARGET_IP -x -b 'DC=<DC>,DC=<ORG>' -D '<DC>\<user>' -W > outfile
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
## Domain Dump
|
|
|
|
|
|
2023-08-09 21:50:10 +02:00
|
|
|
If a set of LDAP credentials is known dump the domain via
|
2022-11-13 01:16:26 +01:00
|
|
|
```sh
|
|
|
|
|
ldapdomaindump $TARGET_IP -u '<domain>\<user>' -p '<password>' --no-json --no-grep
|
|
|
|
|
```
|
2023-08-09 21:50:10 +02:00
|
|
|
The result is a set of HTML files, take a look at them.
|
