# MsLDAPDump | LDAP Enumeration Tool

**URL:** <https://onehack.st/t/msldapdump-ldap-enumeration-tool/250335>\
**Category:** Tools & Scripts\
**Tags:** tools, programming, technology\
**Created:** [June 28, 2023, 8:36pm UTC](https://onehack.st/t/msldapdump-ldap-enumeration-tool/250335 "2023-06-28T20:36:27Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Prometheus](https://onehack.st/user_avatar/onehack.st/prometheus/32/34950_2.png) [@Prometheus](https://onehack.st/u/Prometheus)\
**Post date:** [June 28, 2023, 8:36pm UTC](https://onehack.st/t/msldapdump-ldap-enumeration-tool/250335/1 "2023-06-28T20:36:27Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/c/4/c49b01f30794ed4ba3a8291a781f480e9a639270.png)

# msLDAPDump

LDAP enumeration tool implemented in Python3

[![ko-fi](https://camo.githubusercontent.com/cd07f1a5d90e454e7bbf69d22ebe4cdbd3a0b3dcf56ba0b6c2495a8e99c776be/68747470733a2f2f6b6f2d66692e636f6d2f696d672f676974687562627574746f6e5f736d2e737667)](https://ko-fi.com/M4M03Q2JN)

msLDAPDump simplifies LDAP enumeration in a domain environment by wrapping the lpap3 library from Python in an easy-to-use interface. Like most of my tools, this one works best on Windows. If using Unix, the tool will not resolve hostnames that are not accessible via eth0 currently.

### Binding Anonymously

Users can bind to LDAP anonymously through the tool and dump basic information about LDAP, including domain naming context, domain controller hostnames, and more.

[![](https://github.com/dievus/msLDAPDump/raw/main/images/anonbind.png)](https://github.com/dievus/msLDAPDump/blob/main/images/anonbind.png)

### Credentialed Bind

[![](https://github.com/dievus/msLDAPDump/raw/main/images/authbind.png)](https://github.com/dievus/msLDAPDump/blob/main/images/authbind.png)

[![](https://github.com/dievus/msLDAPDump/raw/main/images/ntlmbind.png)](https://github.com/dievus/msLDAPDump/blob/main/images/ntlmbind.png)

Users can bind to LDAP utilizing valid user account credentials or a valid NTLM hash. Using credentials will obtain the same information as the anonymously binded request, as well as checking for the following:

- Subnet scan for systems with ports 389 and 636 open
- Basic Domain Info (Current user permissions, domain SID, password policy, machine account quota)
- Users
- Groups
- Kerberoastable Accounts
- ASREPRoastable Accounts
- Constrained Delegation
- Unconstrained Delegation
- Computer Accounts - will also attempt DNS lookups on the hostname to identify IP addresses
- Identify Domain Controllers
- Identify Servers
- Identify Deprecated Operating Systems
- Identify MSSQL Servers
- Identify Exchange Servers
- Group Policy Objects (GPO)
- Passwords in User description fields

Each check outputs the raw contents to a text file, and an abbreviated, cleaner version of the results in the terminal environment. The results in the terminal are pulled from the individual text files.

- Add support for LDAPS (LDAP Secure)
- NTLM Authentication
- Figure out why Unix only allows one adapter to make a call out to the LDAP server (removed resolution from Linux until resolved)
- Add support for querying child domain information (currently does not respond nicely to querying child domain controllers)
- Figure out how to link the name to the Description field dump at the end of the script
- Implement command line options rather than inputs
- Check for deprecated operating systems in the domain

### Mandatory Disclaimer

Please keep in mind that this tool is meant for ethical hacking and penetration testing purposes only. I do not condone any behavior that would include testing targets that you do not currently have permission to test against.

## GitHub:

> **[GitHub - dievus/msLDAPDump: LDAP enumeration tool implemented in Python3](https://github.com/dievus/msLDAPDump)**
>
> LDAP enumeration tool implemented in Python3