Back to Port Tracker
🏛️
LDAP
Port 389 / 636Windows
Directory service — anonymous binds leak the whole AD tree: users, groups, descriptions.
// methodology checklist
Step-by-step commands
1
Service scan
howlsec@kali·shell
nmap -p389,636 -sV -sC $thowlsec@kali·shell
nmap -p389 --script ldap-rootdse,ldap-search $t2
Anonymous bind enumeration
howlsec@kali·shell
ldapsearch -x -H ldap://$t -s base namingcontextshowlsec@kali·shell
ldapsearch -x -H ldap://$t -b 'dc=domain,dc=com'howlsec@kali·shell
ldapsearch -x -H ldap://$t -b 'dc=domain,dc=com' '(objectClass=user)' sAMAccountName description3
BloodHound ingest
howlsec@kali·shell
bloodhound-python -u <user> -p <pass> -ns $t -d <domain> -c All