Skip to content
HackIndex.io
LDAP
Service

LDAP

LDAP directory service attacks covering anonymous binds, injection, enumeration of users and groups, relay attacks, credential extraction, and leveraging AD trust paths for lateral movement

:389 :636 13 guides 3 phases
1 min read Created: Dec 28, 2025 Updated: Jul 13, 2026

LDAP (Lightweight Directory Access Protocol) runs on TCP port 389 (plaintext/STARTTLS) and TCP port 636 (LDAPS with TLS). Nmap identifies them as ldap and ldaps. In Active Directory environments, LDAP is the primary protocol for querying the directory: users, groups, computers, policies, and more.

Anonymous or null-bind LDAP access can expose the entire directory structure. Even without credentials, the root DSE and naming contexts are often readable, revealing the domain name and forest structure. With valid credentials, LDAP queries return detailed information about every object in the domain, including password policies, group memberships, SPNs, and delegation settings.

Check for anonymous bind access, then query the base DN, users, groups, and computer objects. Tools like ldapsearch, ldapdomaindump, and windapsearch automate this. Look for accounts with descriptions containing passwords, unconstrained delegation, and AS-REP roastable accounts.

Enumeration

Enumerate LDAP via anonymous and auth binds, users, groups, misconfigs

5

LDAP Authenticated User Group Enumeration

Enumerate Active Directory user groups via authenticated LDAP queries using tools like ldapsearch, BloodHound, and PowerView to map privilege relationships.

Jan 4, 2026 • 6 min read

Vulnerability Discovery

Guides on finding LDAP misconfigs via null bind, signing, and relay checks

2

Exploitation

Anonymous bind, injection, pass-back, brute force, and credential extractio

6
LDAP Brute Force and Password Spraying

LDAP Brute Force and Password Spraying

Exploit LDAP authentication via brute force and password spraying techniques to enumerate valid credentials against directory services.

Mar 11, 2026 • 4 min read