LDAP Commands
30 LDAP commands from the Enumeration category, each with its placeholders, supported authentication methods and upstream references.
Tools covered: bloodhound-python, bloodyAD, impacket-GetADComputers, impacket-GetADUsers, impacket-findDelegation, ldapdomaindump, ldapsearch, nxc, rusthound
- BloodHound AD Collection Collect Active Directory data for BloodHound analysis
- bloodyAD get children List the immediate children of a container or OU. Handy for walking the directory tree without firing a full…
- bloodyAD get dnsDump Dump every AD-integrated DNS record from the domain. Authenticated users can read most zones by default —…
- bloodyAD get membership Recursively resolve every group a principal belongs to, including nested groups. Faster than chasing…
- bloodyAD Get Object Attributes Read all (or specific) LDAP attributes of an AD object. Useful for confirming…
- bloodyAD get search Run an arbitrary LDAP filter against the directory and pull selected attributes. The escape hatch when none…
- bloodyAD get trusts Enumerate domain and forest trust relationships, including direction, type, and trust attributes. Quick…
- bloodyAD get writable Enumerate every AD object the current principal can write to — fastest path to finding ACL escalation…
- Impacket findDelegation Find all accounts with delegation rights (unconstrained, constrained, RBCD)
- Impacket GetADComputers Enumerate all Active Directory computer accounts
- Impacket GetADUsers Enumerate all Active Directory user accounts
- LDAP Anonymous Bind LDAP Anonymous Bind
- LDAP User Enumeration Extract all domain users and save to users.txt
- LDAPDomainDump Dump domain information via LDAP into HTML, JSON, and grep-friendly formats
- NetExec daclread Module Read the DACL of an arbitrary AD object via LDAP and resolve every ACE to a human-readable principal/right…
- NetExec LDAP ADCS Enumeration Enumerate ADCS certificate authorities and templates via NetExec
- NetExec LDAP AdminCount Users Enumerate accounts with adminCount=1 (protected admin accounts) via LDAP
- NetExec LDAP BloodHound Collect BloodHound data via NetExec LDAP module
- NetExec LDAP DC List Enumerate all Domain Controllers in the domain via LDAP
- NetExec LDAP Enumerate CA Enumerate Certificate Authority (CA) servers in Active Directory
- NetExec LDAP Enumerate DNS Enumerate DNS zones and records stored in Active Directory via LDAP
- NetExec LDAP Enumerate Subnets Enumerate AD Sites and Services subnets from Active Directory
- NetExec LDAP Enumerate Trusts Enumerate domain trust relationships via LDAP
- NetExec LDAP Find Delegation Find all accounts with delegation rights via LDAP
- NetExec LDAP Machine Account Quota Check the Machine Account Quota (ms-DS-MachineAccountQuota) for the domain
- NetExec LDAP MSOL Account Retrieve the cleartext password of the MSOL (Azure AD Connect) sync account
- NetExec LDAP Signing Checker Check if LDAP signing and channel binding are enforced on the domain controller
- NetExec LDAP User Descriptions Extract user account descriptions via LDAP
- NetExec pre2k Module Enumerate computer accounts that still use the pre-Windows-2000 compatible access default password (the…
- RustHound BloodHound Collection Collect Active Directory data for BloodHound using RustHound (Kerberos-aware)