timsonner Ldapsearch
Purpose
Use this skill for low-impact directory service enumeration in approved internal environments.
Phase Fit
- Primary: Discovery and Reconnaissance, Vulnerability Analysis
- Secondary: Retest and Closure
Use When
- Need to inspect rootDSE, naming contexts, or directory objects.
- Need to validate LDAP exposure or access boundaries.
- Need a low-impact way to understand identity structure before deeper testing.
Avoid When
- The directory service is out of scope.
- Search bases or credentials are unclear.
Inputs
- Approved LDAP host or domain controller
- Anonymous or credentialed bind context
- Search base and object focus
Procedure
- Start with the lightest query that answers the question.
- Confirm naming contexts and directory reachability.
- Scope object searches tightly to the current hypothesis.
- Compare observed access to expected identity boundaries.
- Preserve search filters and bases for retest.
Command Syntax
Replace sample targets with approved in-scope assets and authorized credentials.
# Unauthenticated base query to discover naming context
ldapsearch -x -H ldap://dc01.contoso.com -s base -b '' namingContexts
# Enumerate all users (authenticated)
ldapsearch -x -H ldap://dc01.contoso.com -D 'auditor@contoso.com' -w '<password>' -b 'DC=contoso,DC=com' '(objectClass=user)' sAMAccountName userPrincipalName
# Enumerate groups and memberships
ldapsearch -x -H ldap://dc01.contoso.com -D 'auditor@contoso.com' -w '<password>' -b 'DC=contoso,DC=com' '(objectClass=group)' cn member
# LDAPS on port 636
ldapsearch -x -H ldaps://dc01.contoso.com:636 -D 'auditor@contoso.com' -w '<password>' -b 'DC=contoso,DC=com' '(objectClass=user)'
# Dump all attributes for a specific account
ldapsearch -x -H ldap://dc01.contoso.com -D 'auditor@contoso.com' -w '<password>' -b 'DC=contoso,DC=com' '(sAMAccountName=administrator)'
# Enumerate computer objects
ldapsearch -x -H ldap://dc01.contoso.com -D 'auditor@contoso.com' -w '<password>' -b 'DC=contoso,DC=com' '(objectClass=computer)' cn operatingSystem
Evidence to Capture
- Naming contexts and reachable directory structure
- Object exposure or access differences by bind context
- Exact filters used for the material observation
Safety Boundaries
- Keep filters narrow and bind only with approved accounts.
- Avoid broad directory harvesting beyond the phase objective.