pentesting-ldap

name	pentesting-ldap
description	Testing LDAP / LDAPS directory services (389, 636, and Global Catalog 3268/3269) including Active Directory during authorized engagements. Covers anonymous/null bind enumeration, naming-context discovery, user/group/computer extraction with ldapsearch and netexec, credentialed domain dumping (ldapdomaindump, windapsearch, BloodHound), cleartext credential sniffing, writable-attribute abuse (sshPublicKey), and harvesting bind creds from client configs.
domain	cybersecurity
subdomain	network-services-pentesting
tags	["penetration-testing","network-services","ldap","active-directory","enumeration","bloodhound"]
version	1.0
author	xalgorix
license	Apache-2.0

Pentesting LDAP (ports 389/636/3268/3269)

When to Use

• During authorized AD/directory assessments when 389, 636, 3268, or 3269 is open
• When you need to enumerate users, groups, computers, and the password policy
• When testing for anonymous/null binds that expose the directory unauthenticated
• When you have valid credentials and want a full domain dump or BloodHound collection
• When assessing Linux hosts integrated with LDAP/AD for leaked bind credentials in client configs

Quick Enumeration

# Confirm service and grab public info (anonymous)
nmap -n -sV --script "ldap* and not brute" <IP>
nmap -p 389 --script ldap-search -Pn <IP>

# Naming context / rootDSE (base DN autodetected) — no creds
ldapsearch -x -H ldap://<IP> -s base namingcontexts
ldapsearch -x -H ldap://<IP> -s base -b '' "(objectClass=*)" "*" +

# netexec LDAP module
netexec ldap <DC_FQDN> -u '' -p ''                      # anonymous probe
ldapsearch -x -H ldap://<IP> -D '' -w '' -b "DC=<sub>,DC=<tld>"

Critical: Checks Most Often Missed

1. Anonymous / null bind — legacy or misconfigured directories allow unauthenticated reads of the entire tree: users, groups, computers, attributes, and the password policy. Test ldapsearch -x -D '' -w '' and netexec ldap -u '' -p ''.
2. Cleartext LDAP (no TLS) — plain 389 lets you sniff bind credentials on the wire; also enables a downgrade MITM where a TLS client falls back to cleartext.
3. Writable user attributes — if you can modify sshPublicKey, and SSH reads keys from LDAP, you can log in as that user even without their password. Check write access to high-value attributes.
4. Bind creds in client configs — on LDAP-joined Linux, /etc/sssd/sssd.conf, /etc/nslcd.conf, and /etc/ldap/ldap.conf often hold reusable ldap_default_bind_dn + ldap_default_authtok. World-readable configs are a quick win.
5. userPassword / description leakage — directory entries sometimes store passwords or password hints in readable attributes; grep query output for them.