timsonner Ldapdomaindump
Purpose
Use this skill to generate a structured view of an approved AD environment when the methodology needs more context than point queries.
Phase Fit
- Primary: Discovery and Reconnaissance, Threat Modeling and Test Planning
- Secondary: Vulnerability Analysis, Retest and Closure
Use When
- Need a coherent directory inventory of users, groups, computers, and trusts.
- Need to support AD path analysis or privilege review.
- Need a repeatable baseline for retest.
Avoid When
- Directory scope or bind permissions are unclear.
- Broad collection would exceed the approved impact level.
Inputs
- Approved domain controller
- Authorized bind account if needed
- Output location and evidence-handling rules
Procedure
- Confirm scope and bind context before collection.
- Keep the collection limited to the approved domain.
- Review the output for privilege-relevant relationships and unexpected exposure.
- Correlate interesting objects with
bloodhound,ldapsearch, or manual validation. - Preserve the exact collection scope for retest.
Command Syntax
Replace sample targets with approved in-scope assets and authorized credentials.
# Full domain dump over LDAP
ldapdomaindump -u 'contoso\auditor' -p '<password>' 10.10.10.10 -o contoso-ldapdump/
# Dump over LDAPS
ldapdomaindump -u 'auditor@contoso.com' -p '<password>' ldaps://dc01.contoso.com -o contoso-ldapdump/
# Output JSON only (no HTML or grep files)
ldapdomaindump -u 'contoso\auditor' -p '<password>' 10.10.10.10 -o contoso-ldapdump/ --no-html --no-grep
# Unauthenticated attempt
ldapdomaindump 10.10.10.10 -o contoso-ldapdump/
Evidence to Capture
- Domain objects and relationships that materially change risk
- Group or trust structures relevant to privilege review
- Exact domain scope and bind context used
Safety Boundaries
- Keep collection scoped to the approved domain.
- Protect generated outputs as sensitive evidence.