XUTS LABS
Back to Red Team Playbooks
Active DirectoryRed Team Playbook

LDAP Enumeration

Collect naming contexts, users, groups, computers, delegation hints, and policy data with correct LDAP syntax.

LDAPActive DirectoryEnumeration

Purpose

Turn a known DC/domain into structured directory evidence for attack-path reasoning.

Inputs

  • - DC_IP
  • - BASE_DN
  • - DOMAIN\user
  • - Password or approved auth material
  • - output directory

Prerequisites

  • - DC_IP
  • - DOMAIN or base DN
  • - LDAP reachable
  • - Credentials for object enumeration when anonymous bind is blocked

Operator Assumptions

  • - RootDSE can be attempted without credentials.
  • - Object enumeration should use a known base DN.

Commands

RootDSE

Kali
ldapsearch -x -H ldap://DC_IP -s base -b '' namingContexts defaultNamingContext dnsHostName

Why: Find the directory naming base.

Expected: A defaultNamingContext value.

Domain dump

Kali
ldapdomaindump ldap://DC_IP -u 'DOMAIN\user' -p 'Password' -o ldapdomaindump-out

Why: Collect users, groups, computers, ACL hints, and policy summaries.

Expected: HTML/JSON files in ldapdomaindump-out.

Targeted users

Kali
ldapsearch -x -H ldap://DC_IP -D 'DOMAIN\user' -w 'Password' -b 'BASE_DN' '(objectClass=user)' sAMAccountName userAccountControl servicePrincipalName

Why: Confirm user and SPN data without relying on a broad dump.

Expected: User entries with selected attributes.

Decision Points

  • - If bind fails, verify DOMAIN format and password quoting.
  • - If SPNs appear, consider Kerberoasting.
  • - If pre-auth flags appear, consider AS-REP Roasting.

Follow-On Actions

  • - Kerberoasting
  • - AS-REP Roasting
  • - BloodHound Collection

Evidence To Capture

  • - RootDSE output
  • - ldapdomaindump files
  • - Targeted LDAP query output

Common Failures

  • - Wrong BASE_DN
  • - Shell escaping on DOMAIN\user
  • - LDAPS required instead of LDAP

Operational Cautions

  • - Avoid dumping unnecessary attributes from fragile DCs.
  • - Do not paste passwords into reports or chat logs.

Related Content

LDAP EnumerationAsk EXO