# Impacket Lookupsid

> Use for SID and domain object enumeration during authorized internal pentests. Trigger on approved domain metadata review, account discovery validation, and understanding what a target reveals about identities over RPC.

- Skill: `timsonner/impacket-lookupsid` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/impacket-lookupsid`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/impacket-lookupsid/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/impacket-lookupsid

---


# Impacket Lookupsid

## Purpose

Use this skill for focused SID-to-name enumeration against approved Windows targets.

## Phase Fit

- Primary: Discovery and Reconnaissance, Threat Modeling and Test Planning
- Secondary: Vulnerability Analysis, Retest and Closure

## Use When

- Need to understand what identity metadata a target leaks over RPC.
- Need to support later AD or privilege-path analysis.
- Need a lightweight enumeration path to confirm account discovery.

## Avoid When

- The host is out of scope.
- Broader identity harvesting is not justified by the current phase objective.

## Inputs

- Approved target host
- Anonymous or authorized credential context
- Narrow RID range or enumeration goal

## Procedure

1. Start with the narrowest RID scope that answers the question.
2. Record only material identity exposure, not every object returned.
3. Correlate results with other directory findings.
4. Preserve the exact target and scope for retest.
5. Treat the output as discovery context, not standalone impact proof.

## Command Syntax

Replace sample targets with approved in-scope assets and authorized credentials.

```bash
# Enumerate SIDs with credentials
lookupsid.py contoso.com/auditor:'<password>'@10.10.10.10

# Unauthenticated attempt (null/guest session)
lookupsid.py -no-pass contoso.com/guest@10.10.10.10

# Limit SID brute-force range
lookupsid.py contoso.com/auditor:'<password>'@10.10.10.10 5000

# Pass-the-Hash
lookupsid.py -hashes :<NTLM_hash> contoso.com/administrator@10.10.10.10
```

## Evidence to Capture

- Identity metadata exposed by the target
- Exact host, auth context, and scope used
- Why the result matters to later attack-path analysis

## Safety Boundaries

- Keep the scope limited to the approved host and discovery need.
- Do not treat raw identity lists as proof of compromise.