During authorized AD/directory assessments when 389, 636, 3268, or 3269 is open
When you need to enumerate users, groups, computers, and the password policy
When testing for anonymous/null binds that expose the directory unauthenticated
When you have valid credentials and want a full domain dump or BloodHound collection
When assessing Linux hosts integrated with LDAP/AD for leaked bind credentials in client configs
Quick Enumeration
# Confirm service and grab public info (anonymous)
nmap -n -sV --script "ldap* and not brute" <IP>
nmap -p 389 --script ldap-search -Pn <IP>
# Naming context / rootDSE (base DN autodetected) — no creds
ldapsearch -x -H ldap://<IP> -s base namingcontexts
ldapsearch -x -H ldap://<IP> -s base -b ''"(objectClass=*)""*" +
# netexec LDAP module
netexec ldap <DC_FQDN> -u '' -p ''# anonymous probe
ldapsearch -x -H ldap://<IP> -D '' -w '' -b "DC=<sub>,DC=<tld>"
Critical: Checks Most Often Missed
Anonymous / null bind — legacy or misconfigured directories allow unauthenticated reads of the entire tree: users, groups, computers, attributes, and the password policy. Test ldapsearch -x -D '' -w '' and netexec ldap -u '' -p ''.
Cleartext LDAP (no TLS) — plain 389 lets you sniff bind credentials on the wire; also enables a downgrade MITM where a TLS client falls back to cleartext.
Writable user attributes — if you can modify sshPublicKey, and SSH reads keys from LDAP, you can log in as that user even without their password. Check write access to high-value attributes.
Bind creds in client configs — on LDAP-joined Linux, /etc/sssd/sssd.conf, /etc/nslcd.conf, and /etc/ldap/ldap.conf often hold reusable ldap_default_bind_dn + ldap_default_authtok. World-readable configs are a quick win.
userPassword / description leakage — directory entries sometimes store passwords or password hints in readable attributes; grep query output for them.
How to CONFIRM: an anonymous bind is confirmed when an unauthenticated ldapsearch -x returns directory entries (not just rootDSE). If you see Operations error ... successful bind must be completed, the bind is rejected (anonymous disabled or creds invalid).
Enumerate users/groups/computers/privileged users via LDAP
python ldap3
Scripted enumeration and attribute modification
BloodHound
Graph analysis of AD attack paths from LDAP data
godap / JXplorer / Apache Directory Studio
Interactive LDAP clients
Common Scenarios
Scenario 1: Anonymous Bind Full Disclosure
A misconfigured DC allows null binds. netexec ldap <DC> -u '' -p '' --query "(sAMAccountName=*)" dumps every user and the password policy, seeding a targeted password spray.
Scenario 2: Bind Creds in sssd.conf
A world-readable /etc/sssd/sssd.conf on a Linux host exposes ldap_default_bind_dn and ldap_default_authtok, which authenticate to the directory and pull privileged group memberships.
Scenario 3: sshPublicKey Injection
The tester can modify a service account's sshPublicKey. After injecting an attacker key, SSH (configured to read keys from LDAP) grants login as that account.
Scenario 4: Credentialed BloodHound
With a valid low-priv credential, nxc ldap ... --bloodhound -c All collects the graph, revealing a short path from the compromised user to Domain Admins.
