505 B

Raw Blame History

LDAP

Get Domain

ldapsearch -H ldap://$TARGET_IP -x -s base namingcontexts

Use found namingcontexts DC

ldapsearch -H ldap://$TARGET_IP -x -b 'DC=<DC>,DC=<ORG>

Authenticated LDAP Search

ldapsearch -H ldap://$TARGET_IP -x -b 'DC=<DC>,DC=<ORG>' -D '<DC>\<user>' -W > outfile

Domain Dump

If a set of credentials are known via

ldapdomaindump $TARGET_IP  -u '<domain>\<user>' -p '<password>' --no-json --no-grep

Take a look at the genreated HTML files