> For the complete documentation index, see [llms.txt](https://d4rk1337.gitbook.io/the-pentesters-cheat-sheet/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://d4rk1337.gitbook.io/the-pentesters-cheat-sheet/services/tcp/tcp-389-636-3268-3269-ldap.md).

# TCP 389, 636, 3268, 3269: LDAP

> The Lightweight Directory Access Protocol (**LDAP**) is an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network.
>
> \-- [*Wikipedia*](https://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol)

## Related

* [Active Directoy](/the-pentesters-cheat-sheet/services/misc/active-directoy.md)
* [TCP 88: Kerberos](/the-pentesters-cheat-sheet/services/tcp/tcp-88-kerberos.md)
* [Impacket](/the-pentesters-cheat-sheet/misc/impacket.md)

## Enumeration

### ldapsearch

```bash
ldapsearch -x -H ldap://<ip> -s base namingcontexts
```

Using namingcontexts from previous call

```bash
ldapsearch -x -H ldap://<ip> -b 'dc=lightweight,dc=htb'
```

Look for `userPassword`s, `description` (sometimes admins put interessting stuff there)

### windapsearch

Most stuff requires a valid user account

```bash
windapsearch.py --dc-ip <ip>
```

Dump all

```bash
./windapsearch.py --dc-ip <ip> -u <user> -p <pw> -G -U -PU -C --da --admin-objects --user-spns --unconstrained-users --unconstrained-computers --gpos --full
```

### Capture requests (e.g. Wireshark)

Find password in request:\
LDAP -> bindRequest -> authentication: simple -> PASSWORD