LDAP directory search tool for querying Active Directory to enumerate users, groups, computers, organizational units, and domain policies.
ldapsearch -x -H {uri} -b {base-dn} 🌍 uri → string 🌍 base-dn → string ldapsearch -x -H {uri} -b {base-dn}Sandbox: execFile · Timeout: 60s
security.ad.enum.users security.ad.enum.groups security.ad.enum.computers security.ad.enum.ous security.ad.enum.gpos security.ad.ldap.query | Name | Type | Required | Default | Description | Aliases |
|---|---|---|---|---|---|
simple | boolean | No | Use simple authentication (not SASL) | -x, --simple | |
uri | string | No | - | LDAP server URI (ldap://host:port) | -H, --uri |
bind-dn | string | No | - | Distinguished name to bind as | -D, --bind-dn |
password | string | No | - | Password for LDAP bind | -w, --password |
base-dn | string | No | - | Base DN for search | -b, --base-dn |
scope | string | No | sub | Search scope (base, one, sub, children) | -s, --scope |
filter | string | No | (objectClass=*) | LDAP search filter | -f, --filter |
format | boolean | No | LDIF format with comments only | -LLL | |
time-limit | integer | No | 0 | Time limit in seconds for search | -l, --time-limit |
size-limit | integer | No | 0 | Maximum number of entries to return | -z, --size-limit |
host | string | No | - | LDAP server hostname | -h, --host |
port | integer | No | 389 | LDAP server port | -p, --port |
starttls | boolean | No | Use STARTTLS to upgrade to TLS | -Z, --starttls | |
E | boolean | No | - | LDAP extensions | -E, --extensions |
LLL | boolean | No | - | LDIF format (no comments/version) | -LLL |
O | boolean | No | - | Security properties | -O, --security |
Y | boolean | No | - | SASL authorization identity | -Y, --authzid |
o | boolean | No | - | General options | -o, --options |
v | boolean | No | - | Verbose output | -v, --verbose |
Inputs
network.target.uri LDAP server URI (ldap:// or ldaps://)
credential.binddn Distinguished name for LDAP bind
credential.password Password for LDAP bind
ldap.basedn Base DN for search scope
Outputs
security.ad.enum.results LDAP query results in LDIF format
network_traffic Produces
security.ad.enum.resultsConsumes
network.target.uricredential.binddncredential.passwordldap.basedn| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Anonymous LDAP query to retrieve base DSE
ldapsearch -x -H ldap://10.10.10.1 -b "" -s baseEnumerate all users in the domain
ldapsearch -x -H ldap://10.10.10.1 -D jdoe@evilcorp.local -w Pass123 -b dc=evilcorp,dc=local "(objectClass=user)"Enumerate all domain groups
ldapsearch -x -H ldap://10.10.10.1 -D jdoe@evilcorp.local -w Pass123 -b dc=evilcorp,dc=local "(objectClass=group)"Find domain admins group members
ldapsearch -x -H ldap://10.10.10.1 -D jdoe@evilcorp.local -w Pass123 -b dc=evilcorp,dc=local "(&(objectClass=group)(cn=Domain Admins))" memberEnumerate all computers in the domain
ldapsearch -x -H ldap://10.10.10.1 -D jdoe@evilcorp.local -w Pass123 -b dc=evilcorp,dc=local "(objectClass=computer)"Search for users with SPNs (kerberoast target)
ldapsearch -x -H ldap://10.10.10.1 -D jdoe@evilcorp.local -w Pass123 -b dc=evilcorp,dc=local "(&(objectClass=user)(servicePrincipalName=*))" servicePrincipalNameFind users with Kerberos pre-auth disabled (AS-REP roast)
ldapsearch -x -H ldap://10.10.10.1 -D jdoe@evilcorp.local -w Pass123 -b dc=evilcorp,dc=local "(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=4194304))" samaccountnameldapsearch is the standard command-line LDAP search tool from OpenLDAP, used to query Active Directory and other LDAP-compliant directory services.
| Query | LDAP Filter |
|---|---|
| All users | (objectClass=user) |
| All groups | (objectClass=group) |
| All computers | (objectClass=computer) |
| Domain Admins | (&(objectClass=group)(cn=Domain Admins)) |
| Users with SPNs | (&(objectClass=user)(servicePrincipalName=*)) |
| Users without pre-auth | (&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=4194304)) |
| Locked out users | (&(objectClass=user)(lockoutTime>=1)) |
| Disabled users | (&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=2)) |
If the domain controller allows anonymous LDAP queries, you can enumerate significant AD information without any credentials using ldapsearch -x -H ldap://DC_IP -b dc=domain,dc=local -s sub "(objectClass=*)".