> For the complete documentation index, see [llms.txt](https://hacker-mind.gitbook.io/hacker-mind/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacker-mind.gitbook.io/hacker-mind/penetration-testing-notes/ldap.md).

# LDAP

```
nmap -n -sV --script "ldap* and not brute" -p 389 <DC IP>
  
ldapsearch -H ldap://$IP -x -s base
# note the defalultNamingContext


ldapsearch -H ldap://$IP -x -b "DC=htb, DC=local"

# check password in the description
ldapsearch -H ldap://$IP -x -b "DC=htb, DC=local" | grep description

ldapsearch -H ldap://$IP -x -b "DC=htb, DC=local" 'objectClass=user'
```

Other trick:

```
# https://github.com/ropnop/windapsearch

./windapsearch.py -d egotistical-bank.local --dc-ip 10.10.10.175 -U

GetADUsers.py egotistical-bank.local/ -dc-ip 10.10.10.175 -debug
```