# Ldapsearch

> Use for LDAP and directory service enumeration during authorized internal assessments. Trigger on identity store review, rootDSE checks, naming context discovery, and validating directory exposure with approved credentials.

- Skill: `timsonner/ldapsearch` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/ldapsearch`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/ldapsearch/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/ldapsearch

---


# Ldapsearch

## Purpose

Use this skill for low-impact directory service enumeration in approved internal environments.

## Phase Fit

- Primary: Discovery and Reconnaissance, Vulnerability Analysis
- Secondary: Retest and Closure

## Use When

- Need to inspect rootDSE, naming contexts, or directory objects.
- Need to validate LDAP exposure or access boundaries.
- Need a low-impact way to understand identity structure before deeper testing.

## Avoid When

- The directory service is out of scope.
- Search bases or credentials are unclear.

## Inputs

- Approved LDAP host or domain controller
- Anonymous or credentialed bind context
- Search base and object focus

## Procedure

1. Start with the lightest query that answers the question.
2. Confirm naming contexts and directory reachability.
3. Scope object searches tightly to the current hypothesis.
4. Compare observed access to expected identity boundaries.
5. Preserve search filters and bases for retest.

## Command Syntax

Replace sample targets with approved in-scope assets and authorized credentials.

```bash
# Unauthenticated base query to discover naming context
ldapsearch -x -H ldap://dc01.contoso.com -s base -b '' namingContexts

# Enumerate all users (authenticated)
ldapsearch -x -H ldap://dc01.contoso.com -D 'auditor@contoso.com' -w '<password>' -b 'DC=contoso,DC=com' '(objectClass=user)' sAMAccountName userPrincipalName

# Enumerate groups and memberships
ldapsearch -x -H ldap://dc01.contoso.com -D 'auditor@contoso.com' -w '<password>' -b 'DC=contoso,DC=com' '(objectClass=group)' cn member

# LDAPS on port 636
ldapsearch -x -H ldaps://dc01.contoso.com:636 -D 'auditor@contoso.com' -w '<password>' -b 'DC=contoso,DC=com' '(objectClass=user)'

# Dump all attributes for a specific account
ldapsearch -x -H ldap://dc01.contoso.com -D 'auditor@contoso.com' -w '<password>' -b 'DC=contoso,DC=com' '(sAMAccountName=administrator)'

# Enumerate computer objects
ldapsearch -x -H ldap://dc01.contoso.com -D 'auditor@contoso.com' -w '<password>' -b 'DC=contoso,DC=com' '(objectClass=computer)' cn operatingSystem
```

## Evidence to Capture

- Naming contexts and reachable directory structure
- Object exposure or access differences by bind context
- Exact filters used for the material observation

## Safety Boundaries

- Keep filters narrow and bind only with approved accounts.
- Avoid broad directory harvesting beyond the phase objective.