# Ldapdomaindump

> Use for structured Active Directory LDAP inventory during authorized internal pentests. Trigger on approved domain mapping, directory object review, and generating a focused picture of groups, users, and trust relationships.

- Skill: `timsonner/ldapdomaindump` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/ldapdomaindump`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/ldapdomaindump/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/ldapdomaindump

---


# Ldapdomaindump

## Purpose

Use this skill to generate a structured view of an approved AD environment when the methodology needs more context than point queries.

## Phase Fit

- Primary: Discovery and Reconnaissance, Threat Modeling and Test Planning
- Secondary: Vulnerability Analysis, Retest and Closure

## Use When

- Need a coherent directory inventory of users, groups, computers, and trusts.
- Need to support AD path analysis or privilege review.
- Need a repeatable baseline for retest.

## Avoid When

- Directory scope or bind permissions are unclear.
- Broad collection would exceed the approved impact level.

## Inputs

- Approved domain controller
- Authorized bind account if needed
- Output location and evidence-handling rules

## Procedure

1. Confirm scope and bind context before collection.
2. Keep the collection limited to the approved domain.
3. Review the output for privilege-relevant relationships and unexpected exposure.
4. Correlate interesting objects with `bloodhound`, `ldapsearch`, or manual validation.
5. Preserve the exact collection scope for retest.

## Command Syntax

Replace sample targets with approved in-scope assets and authorized credentials.

```bash
# Full domain dump over LDAP
ldapdomaindump -u 'contoso\auditor' -p '<password>' 10.10.10.10 -o contoso-ldapdump/

# Dump over LDAPS
ldapdomaindump -u 'auditor@contoso.com' -p '<password>' ldaps://dc01.contoso.com -o contoso-ldapdump/

# Output JSON only (no HTML or grep files)
ldapdomaindump -u 'contoso\auditor' -p '<password>' 10.10.10.10 -o contoso-ldapdump/ --no-html --no-grep

# Unauthenticated attempt
ldapdomaindump 10.10.10.10 -o contoso-ldapdump/
```

## Evidence to Capture

- Domain objects and relationships that materially change risk
- Group or trust structures relevant to privilege review
- Exact domain scope and bind context used

## Safety Boundaries

- Keep collection scoped to the approved domain.
- Protect generated outputs as sensitive evidence.