GO KALI FREE

ldapsearch

Information Gathering

Intermediatemedium risk

ldapsearch is a shell-accessible interface to the ldap_search_ext library function, designed to open active queries against corporate Active Directory database frameworks.

Installation

sudo apt install ldap-utils

Basic Syntax

ldapsearch [options]

Quick Facts

Full Name
LDAPsearch (OpenLDAP)
License
OpenLDAP Public License
Author
OpenLDAP Project
Written In
C
Platforms
Linux, macOS, Windows
Category
LDAP Enumeration
Protocol
LDAPv2, LDAPv3

Tool Overview

LDAPsearch is a command-line tool from the OpenLDAP project for querying LDAP directories. It sends LDAP search requests to directory servers and returns matching entries, making it essential for Active Directory enumeration.

In Windows environments, Active Directory stores all domain information in an LDAP-accessible directory. LDAPsearch can query this directory to enumerate users, groups, computers, organizational units, group policies, and domain trusts.

The tool supports complex LDAP filters for precise queries, attribute selection for targeted data extraction, and various output formats. It is the foundation tool for AD enumeration in penetration testing.

Common Commands

ldapsearch -x -h 192.168.1.1 -b "dc=example,dc=com"Anonymous search - Query target LDAP directory schemas using simple authentication models
ldapsearch -x -H ldap://192.168.1.1 -s base namingcontextsGet base DN
ldapsearch -x -H ldap://192.168.1.1 -b "DC=domain,DC=com"Dump all objects
ldapsearch -x -H ldap://192.168.1.1 -b "DC=domain,DC=com" "(objectClass=user)"List users
ldapsearch -x -H ldap://192.168.1.1 -b "DC=domain,DC=com" "(objectClass=group)"List groups
ldapsearch -x -H ldap://192.168.1.1 -D "user@domain.com" -W -b "DC=domain,DC=com"Authenticated query
ldapsearch -x -h 192.168.1.100 -b 'DC=example,DC=com'Basic LDAP search
ldapsearch -x -h 192.168.1.100 -b 'DC=example,DC=com' '(objectClass=user)'Search for user objects
ldapsearch -x -h 192.168.1.100 -b 'DC=example,DC=com' '(objectClass=computer)'Search for computer objects
ldapsearch -x -h 192.168.1.100 -b 'DC=example,DC=com' '(memberOf=CN=Admins)'Search by group membership
ldapsearch -x -h 192.168.1.100 -b 'DC=example,DC=com' -D 'CN=admin,DC=example,DC=com' -WAuthenticated bind
ldapsearch -x -h 192.168.1.100 -b 'DC=example,DC=com' '(servicePrincipalName=*)' servicePrincipalNameKerberoastable accounts
ldapsearch -x -h 192.168.1.100 -b 'DC=example,DC=com' '(userAccountControl:1.2.840.113556.1.4.803:=8192)'Find domain controllers
ldapsearch -x -h 192.168.1.100 -b 'CN=Configuration,DC=example,DC=com' '(objectClass=domainDNS)'Query configuration partition
ldapsearch -x -h 192.168.1.100 -b 'DC=example,DC=com' '(adminCount=1)'Find privileged accounts

Step-by-Step Guide

  1. 1Determine the correct base distinguished name for the target directory
  2. 2Attempt an unauthenticated connection to verify open schemas
  3. 3Extract the lists of active users and security groups
  4. 4Search the results for attributes containing passwords or descriptions
  5. 5Save the raw output into a file to grep through later

Use Cases

User Enumeration

Extract all user accounts from Active Directory.

Group Discovery

Enumerate security groups and their members.

Computer Enumeration

Discover domain-joined computers and their details.

Policy Discovery

Query Group Policy Objects and configurations.

Trust Mapping

Discover domain trusts and forest relationships.

Key Features

Related Tools

Bloodhound

Information Gathering

Visual AD attack path analysis.

Enum4linux

Information Gathering

SMB-based domain enumeration.

Frequently Asked Questions

What is LDAPsearch used for?

LDAPsearch is used for querying LDAP directories like Active Directory. It enumerates users, groups, computers, organizational units, and other directory objects through LDAP queries.

What is LDAP?

LDAP (Lightweight Directory Access Protocol) is a protocol for accessing and managing directory information. Active Directory uses LDAP to store user accounts, groups, computers, and policy data.

Can LDAPsearch enumerate Active Directory?

Yes, LDAPsearch is one of the primary tools for AD enumeration. It can query users, groups, computers, GPOs, trusts, and other AD objects through LDAP queries.

Do I need credentials for LDAPsearch?

Anonymous LDAP binds are sometimes possible but often restricted. Most AD environments require valid domain credentials for LDAP queries.

Tags

#reconnaissance#ldap#active-directory#domain-enumeration

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.